Updated WebKit from /home/shausman/src/webkit/trunk to origin/qtwebkit-4.6-staging ( b2abc0c271880b8135507861056af497f895adf5 )

Changes in WebKit since the last update:

++ b/WebKit/qt/ChangeLog
2009-07-13  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Fix qdoc warnings for QWebPage::shouldInterruptJavaScript() and mention
        how to re-implement it.

        * Api/qwebpage.cpp:

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Fix crash with plugins when the plugin stream is cancelled.

        Similar to r26667 handle the case where didReceiveResponse on the
        plugin view results in failure to set up the stream and
        setMainDocumentError being called instead. This will set the
        m_pluginView back to 0 and we need check for it before calling
        didReceiveData.

        This was triggered by consecutive execution of
        LayoutTests/plugins/return-error-from-new-stream-callback-in-full-frame-plugin.html
        followed by LayoutTests/scrollbars/scrollbar-crash-on-refresh.html

        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::committedLoad):

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Added QWebDatabase::removeAllDatabases, as a way to delete all
        databases from the offline storage path.

        Used by the Qt DRT.

        * Api/qwebdatabase.cpp:
        (QWebDatabase::removeAllDatabases):
        * Api/qwebdatabase.h:

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Added loadStarted() and loadFinished() signals to QWebFrame,
        to allow load tracking of individual frames, as opposed to
        QWebPage's loadStarted/loadFinished signals that are emitted
        whenever _any_ child frame loads/finishes.

        * Api/qwebframe.cpp: Document new signals.
        * Api/qwebframe.h: Add new signals.
        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::setFrame): Connect new signals.

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Add hooks for the GCController JavaScript interface needed by the
        Qt DRT.

        Fixed sort order of includes in qwebframe.cpp.

        * Api/qwebframe.cpp:
        (qt_drt_javaScriptObjectsCount):
        (qt_drt_garbageCollector_collect):
        (qt_drt_garbageCollector_collectOnAlternateThread):

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Add hooks for the GCController JavaScript interface needed by the
        Qt DRT.

        Fixed sort order of includes in qwebframe.cpp.

        * Api/qwebframe.cpp:
        (qt_drt_javaScriptObjectsCount):
        (qt_drt_garbageCollector_collect):
        (qt_drt_garbageCollector_collectOnAlternateThread):

2009-07-12  Brent Fulgham  <bfulgham@gmail.com>

        Speculative build fix after http://trac.webkit.org/changeset/45786.

        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::addMessageToConsole):
        * WebCoreSupport/ChromeClientQt.h:

2009-07-10  Yael Aharon  <yael.aharon@nokia.com>

        Reviewed by Holger Freyther.

        https://bugs.webkit.org/show_bug.cgi?id=27136

        Fix a bug where webkit hangs when executing infinite JavaScript loop.

        * Api/qwebpage.cpp:
        (QWebPage::shouldInterruptJavaScript):
        * Api/qwebpage.h:
        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::shouldInterruptJavaScript):
        * tests/qwebpage/tst_qwebpage.cpp:
        (JSTestPage::JSTestPage):
        (JSTestPage::shouldInterruptJavaScript):
        (tst_QWebPage::infiniteLoopJS):

2009-07-10  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Holger Freyther.

        https://bugs.webkit.org/show_bug.cgi?id=27108

        Fix crash when in frame tree of a new frame before the new frame
        has been installed in the frame tree, similar to r35088.

        After calling Frame::init() the frame it may have been removed from the
        frame tree again through JavaScript. Detect this by checking the page()
        afterwards.

        To make this check safe the Frame::init() code was moved into
        QWebFrameData's constructor, where a RefPtr holds a reference to the frame.
        After the check back in FrameLoaderClientQt we would hold the single
        reference left and after release() the frame, its frame loader, its
        client as well as the QWebFrame should have disappeared then.

        * Api/qwebframe.cpp:
        (QWebFramePrivate::init): Only call Frame::init here, the rest is
        done in QWebFrameData's constructor.
        (QWebFrame::QWebFrame):
        * Api/qwebframe_p.h: Adjust declaration.
        (QWebFrameData::QWebFrameData): Create the Frame here.
        * Api/qwebpage.cpp:
        (QWebPagePrivate::createMainFrame): Adjust and simplify
        to new QWebFrame constructor.
        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::createFrame): Adjust to
        new QWebFrame construction using QWebFrameData and add the
        check like in r35088.

2009-07-09  Beth Dakin  <bdakin@apple.com>

        Reviewed by Dave Hyatt.

        Make Widget RefCounted to fix:

        <rdar://problem/7038831> REGRESSION (TOT): In Mail, a crash occurs
        at WebCore::Widget::afterMouseDown() after clicking To Do's close
        box
        <rdar://problem/6978804> WER #16: Repro Access Violation in
        WebCore::PluginView::bindingInstance (1310178023)
        -and-
        <rdar://problem/6991251> WER #13: Crash in WebKit!
        WebCore::PluginView::performRequest+203 (1311461169)

        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::createPlugin):
        (WebCore::FrameLoaderClientQt::createJavaAppletWidget):
        * WebCoreSupport/FrameLoaderClientQt.h:

2009-07-08  Pradeepto Bhattacharya  <pradeepto@kde.org>

        Reviewed by Ariya Hidayat.

        Build fix.

        * WebCoreSupport/FrameLoaderClientQt.h: Removed the slot slotCallPolicyFunction().

2009-07-08  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Tor Arne Vestbø.

        https://bugs.webkit.org/show_bug.cgi?id=27080

        Fix DRT instability issues with fast/loader/submit-form-while-parsing-2.html

        When the form is submitted we call the policy function in the frame
        loader delayed with a queued connection. That queued connection
        sometimes interferes with the javascript timeout set in the testcase.

        Eliminate the entire delayed policy function mechanism and instead always
        call back directly, like in the other ports. In most other places we called
        the slot directly anyway.

        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::FrameLoaderClientQt): Remove m_policyFunction.
        (WebCore::FrameLoaderClientQt::callPolicyFunction): Call the policy function directly instead
        of emitting the queued signal.
        (WebCore::FrameLoaderClientQt::cancelPolicyCheck): Call callPolicyFunction directly.
        (WebCore::FrameLoaderClientQt::dispatchWillSubmitForm): Ditto.
        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForMIMEType): Ditto.
        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction): Ditto.
        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction): Ditto.
        * WebCoreSupport/FrameLoaderClientQt.h: Remove m_policyFunction as well as the associated
        signal.

2009-07-07  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Holger Freyther.

        Add Qt DRT hook for clearing the frame name.

        * Api/qwebframe.cpp:
        (qt_drt_clearFrameName):

2009-07-05  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Holger Freyther.

        Fix two qdoc warnings.

        Added missing \property for QWebFrame::hasFocus and added \a
        tag for pos of QWebPage::frameAt.

        * Api/qwebframe.cpp:
        * Api/qwebpage.cpp:

2009-07-04  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Simon Hausmann.

        Use the recently introduced FocusController::setFocused

        Use the recently introduced FocusController::setFocused
        in the Qt platform. The SelectionController will be updated
        from within the FocusController now.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::focusInEvent):
        (QWebPagePrivate::focusOutEvent):

2009-07-02  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Improve documentation of QWebFrame::setFocus and hasFocus()
        Added missing Q_PROPERTY for QWebFrame::hasFocus.

        * Api/qwebframe.cpp: Clarify the docs.
        * Api/qwebframe.h: add Q_PROPERTY(focus).

2009-07-02  Joe Ligman  <joseph.ligman@nokia.com>

        Reviewed by Simon Hausmann.

        Bug 26855: [Qt] New methods for QWebFrame to check and set focus.

        Added new public methods QWebFrame::hasFocus() and QWebFrame::setFocus()
        Added auto test.

        * Api/qwebframe.cpp:
        (QWebFrame::hasFocus):
        (QWebFrame::setFocus):
        * Api/qwebframe.h:
        * tests/qwebframe/tst_qwebframe.cpp:

2009-07-01  Robert Hogan <robert@roberthogan.net>

        Reviewed by NOBODY.

        Fix Qt segfault when javascript disabled.
        If clients call addToJavaScriptWindowObject even though JavascriptEnabled is false
        webkit will segfault on the assert:
          ASSERTION FAILED: _rootObject
          (../../../WebCore/bridge/runtime.cpp:52
          JSC::Bindings::Instance::Instance(WTF::PassRefPtr<JSC::Bindings::RootObject>))
        Fix is to ensure JavaScript is enabled when client calls addToJavaScriptWindowObject.

        https://bugs.webkit.org/show_bug.cgi?id=26906

        * Api/qwebframe.cpp:
        (QWebFrame::addToJavaScriptWindowObject):

2009-07-01  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        [Qt] Move some API headers from WebCore.pro to headers.pri so that they
        get installed when running make install from the build directory.

        * Api/headers.pri:

2009-07-01  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>

        Reviewed by Simon Hausmann.

        Fixed robotized QtLauncher to work when there is no index.html in the user's home.

        * QtLauncher/main.cpp:
        (main):

2009-06-30  Brian Weinstein  <bweinstein@apple.com>

        Reviewed by Adam Roben.

        Renamed scrollbarUnderPoint to scrollbarAtPoint to follow conventions.

        * Api/qwebpage.cpp:
        (QWebPage::swallowContextMenuEvent):

2009-06-30  Joe Ligman  <joseph.ligman@nokia.com>

        Reviewed by Adam Treat.

        Bug 26422: [Qt] QWebPagePrivate::frameAt calculates wrong frame

        Added a public method QWebPage::frameAt
        Removed QWebPagePrivate::frameAt, which calcuated the wrong frame
        Modified QWebPage::swallowContextMenuEvent to use the new frameAt method
        New test case for frameAt added to tst_qwebpage.cpp

        * Api/qwebpage.cpp:
        (QWebPage::frameAt):
        (QWebPage::swallowContextMenuEvent):
        * Api/qwebpage.h:
        * Api/qwebpage_p.h:
        * tests/qwebpage/frametest/iframe.html: Added.
        * tests/qwebpage/frametest/iframe2.html: Added.
        * tests/qwebpage/frametest/iframe3.html: Added.
        * tests/qwebpage/tst_qwebpage.cpp:
        (frameAtHelper):
        (tst_QWebPage::frameAt):
        * tests/qwebpage/tst_qwebpage.qrc:

2009-06-30  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        Add QWebFrame::baseUrl() function that exposes the base URL of a frame.
        Autotests included.

        * Api/qwebframe.cpp:
        (QWebFrame::baseUrl):
        * Api/qwebframe.h:
        * tests/qwebframe/tst_qwebframe.cpp:

22 files changed, 384 insertions, 48 deletions

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
new file mode 100644
index 0000000..82e06e3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSAbstractWorker.h"
+
+#include "AbstractWorker.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEventListener.h"
+#include "JSEventTarget.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSAbstractWorker::mark()
+{
+    DOMObject::mark();
+
+    markIfNotNull(m_impl->onerror());
+
+    typedef AbstractWorker::EventListenersMap EventListenersMap;
+    typedef AbstractWorker::ListenerVector ListenerVector;
+    EventListenersMap& eventListeners = m_impl->eventListeners();
+    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
+    }
+}
+
+JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
+    if (!listener)
+        return jsUndefined();
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
+    if (!listener)
+        return jsUndefined();
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue toJS(ExecState* exec, AbstractWorker* baseObject)
+{
+    // Just call the JSEventTarget implementation of toJS(), which already differentiates between the different implementations.
+    return toJS(exec, static_cast<EventTarget*>(baseObject));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 6361e70..ffe8cf5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -84,7 +84,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
         callType = m_customResolver->getCallData(callData);
         if (callType == CallTypeNone) {
             // FIXME: Pass actual line number and source URL.
-            m_frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
+            m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
             return String();
         }
         function = m_customResolver;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 55f0e91..81d59fb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -32,6 +32,7 @@
 #include "EventException.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "HTMLAudioElement.h"
 #include "HTMLImageElement.h"
 #include "HTMLScriptElement.h"
 #include "HTMLNames.h"
@@ -288,6 +289,10 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
             return true;
         if (node->hasTagName(scriptTag) && !static_cast<HTMLScriptElement*>(node)->haveFiredLoadEvent())
             return true;
+#if ENABLE(VIDEO)
+        if (node->hasTagName(audioTag) && !static_cast<HTMLAudioElement*>(node)->paused())
+            return true;
+#endif
     }
 
     return false;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 1378c91..e3fd417 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -86,8 +86,9 @@ namespace WebCore {
             return structure;
         return cacheDOMStructure(globalObject, WrapperClass::createStructure(WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
     }
-    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::Structure* deprecatedGetDOMStructure(JSC::ExecState* exec)
     {
+        // FIXME: This function is wrong.  It uses the wrong global object for creating the prototype structure.
         return getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()));
     }
     template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
@@ -99,7 +100,8 @@ namespace WebCore {
     {
         ASSERT(object);
         ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
-        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec), object);
+        // FIXME: new (exec) could use a different globalData than the globalData this wrapper is cached on.
+        WrapperClass* wrapper = new (exec) WrapperClass(deprecatedGetDOMStructure<WrapperClass>(exec), object);
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
@@ -118,7 +120,7 @@ namespace WebCore {
     {
         ASSERT(object);
         ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
-        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec), object, context);
+        WrapperClass* wrapper = new (exec) WrapperClass(deprecatedGetDOMStructure<WrapperClass>(exec), object, context);
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
@@ -137,7 +139,9 @@ namespace WebCore {
     {
         ASSERT(node);
         ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
-        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec), node);
+        WrapperClass* wrapper = new (exec) WrapperClass(deprecatedGetDOMStructure<WrapperClass>(exec), node);
+        // FIXME: The entire function can be removed, once we fix caching.
+        // This function is a one-off hack to make Nodes cache in the right global object.
         cacheDOMNodeWrapper(node->document(), node, wrapper);
         return wrapper;
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index 0eefebe..0f419ba 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -99,7 +99,7 @@ void JSDOMWindowBase::printErrorMessage(const String& message) const
     if (settings->privateBrowsingEnabled())
         return;
 
-    impl()->console()->addMessage(JSMessageSource, ErrorMessageLevel, message, 1, String()); // FIXME: provide a real line number and source URL.
+    impl()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String()); // FIXME: provide a real line number and source URL.
 }
 
 ExecState* JSDOMWindowBase::globalExec()
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 22013eb..c095bf2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -45,6 +45,7 @@
 #include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
 #include "JSOptionConstructor.h"
+#include "JSSharedWorkerConstructor.h"
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
 #include "JSWorkerConstructor.h"
@@ -476,6 +477,13 @@ JSValue JSDOMWindow::worker(ExecState* exec) const
 }
 #endif
 
+#if ENABLE(SHARED_WORKERS)
+JSValue JSDOMWindow::sharedWorker(ExecState* exec) const
+{
+    return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+}
+#endif
+
 // Custom functions
 
 // Helper for window.open() and window.showModalDialog()
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
index af49df4..c7ffcde 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
@@ -24,6 +24,9 @@
  */
 
 #include "config.h"
+
+#if ENABLE(DATAGRID)
+
 #include "JSDataGridColumnList.h"
 
 #include "AtomicString.h"
@@ -47,3 +50,5 @@ JSValue JSDataGridColumnList::nameGetter(ExecState* exec, const Identifier& prop
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp
index e75b10b..02b4214 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp
@@ -24,6 +24,9 @@
  */
 
 #include "config.h"
+
+#if ENABLE(DATAGRID)
+
 #include "JSDataGridDataSource.h"
 
 #include "Document.h"
@@ -47,34 +50,6 @@ JSDataGridDataSource::~JSDataGridDataSource()
 {
 }
 
-void JSDataGridDataSource::initialize(HTMLDataGridElement* datagrid)
-{
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    JSLock lock(false);
-    RefPtr<JSDataGridDataSource> protect(this);
-
-    ExecState* exec = m_frame->script()->globalObject()->globalExec();
-
-    if (!jsDataSource().isObject())
-        return;
-
-    JSValue initializeFunction = jsDataSource().get(exec, Identifier(exec, "initialize"));
-    CallData callData;
-    CallType callType = initializeFunction.getCallData(callData);
-    if (callType == CallTypeNone)
-        return;
-
-    MarkedArgumentBuffer args;
-    args.append(toJS(exec, datagrid));
-
-    JSDOMWindowBase::commonJSGlobalData()->timeoutChecker.start();
-    call(exec, initializeFunction, callType, callData, m_dataSource, args);
-    JSDOMWindowBase::commonJSGlobalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-}
-
 } // namespace WebCore
+
+#endif // ENABLE(DATAGRID)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h
index 2537b00..077ef8f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h
@@ -26,6 +26,8 @@
 #ifndef JSDataGridDataSource_h
 #define JSDataGridDataSource_h
 
+#if ENABLE(DATAGRID)
+
 #include "DataGridDataSource.h"
 #include <runtime/JSValue.h>
 #include <runtime/Protect.h>
@@ -49,8 +51,6 @@ public:
     virtual bool isJSDataGridDataSource() const { return true; }
     JSC::JSValue jsDataSource() const { return m_dataSource.get(); }
 
-    virtual void initialize(HTMLDataGridElement*);
-
 private:
     JSDataGridDataSource(JSC::JSValue, Frame*);
 
@@ -72,4 +72,5 @@ inline const JSDataGridDataSource* asJSDataGridDataSource(const DataGridDataSour
 
 } // namespace WebCore
 
+#endif // ENABLE(DATAGRID)
 #endif // JSDataGridDataSource_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
index 2058098..875e904 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
@@ -56,6 +56,11 @@
 #include "WorkerContext.h"
 #endif
 
+#if ENABLE(SHARED_WORKERS)
+#include "JSSharedWorker.h"
+#include "SharedWorker.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -101,6 +106,11 @@ JSValue toJS(ExecState* exec, EventTarget* target)
         return toJSDOMGlobalObject(workerContext);
 #endif
 
+#if ENABLE(SHARED_WORKERS)
+    if (SharedWorker* sharedWorker = target->toSharedWorker())
+        return toJS(exec, sharedWorker);
+#endif
+
     ASSERT_NOT_REACHED();
     return jsNull();
 }
@@ -132,6 +142,10 @@ EventTarget* toEventTarget(JSC::JSValue value)
     CONVERT_TO_EVENT_TARGET(WorkerContext)
 #endif
 
+#if ENABLE(SHARED_WORKERS)
+    CONVERT_TO_EVENT_TARGET(SharedWorker)
+#endif
+
     return 0;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp
index 5aa0904..a30f5e4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp
@@ -24,6 +24,9 @@
  */
 
 #include "config.h"
+
+#if ENABLE(DATAGRID)
+
 #include "JSHTMLDataGridElement.h"
 
 #include "Document.h"
@@ -44,7 +47,14 @@ JSValue JSHTMLDataGridElement::dataSource(ExecState*) const
 
 void JSHTMLDataGridElement::setDataSource(ExecState*, JSValue value)
 {
+    if (value.isNull()) {
+        static_cast<HTMLDataGridElement*>(impl())->setDataSource(0);
+        return;
+    }
+
     static_cast<HTMLDataGridElement*>(impl())->setDataSource(JSDataGridDataSource::create(value, impl()->document()->frame()));
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(DATAGRID)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index 8bf543c..e5b428a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -62,7 +62,7 @@ JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
     Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!activeFrame)
         return jsUndefined();
-    static_cast<HTMLFormElement*>(impl())->submit(0, false, !activeFrame->script()->anyPageIsProcessingUserGesture(), false);
+    static_cast<HTMLFormElement*>(impl())->submit(0, false, !activeFrame->script()->anyPageIsProcessingUserGesture());
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
index f7c74ae..8913243 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -77,7 +77,11 @@ void JSLazyEventListener::parseCode() const
     if (m_parsed)
         return;
 
-    if (m_globalObject->scriptExecutionContext()->isDocument()) {
+    ScriptExecutionContext* executionContext = m_globalObject->scriptExecutionContext();
+    ASSERT(executionContext);
+    if (!executionContext)
+        return;
+    if (executionContext->isDocument()) {
         JSDOMWindow* window = static_cast<JSDOMWindow*>(m_globalObject);
         Frame* frame = window->impl()->frame();
         if (!frame)
@@ -93,7 +97,7 @@ void JSLazyEventListener::parseCode() const
     ExecState* exec = m_globalObject->globalExec();
 
     MarkedArgumentBuffer args;
-    UString sourceURL(m_globalObject->scriptExecutionContext()->url().string());
+    UString sourceURL(executionContext->url().string());
     args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
index 93a8937..af1995b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
@@ -43,7 +43,9 @@ const ClassInfo JSNamedNodesCollection::s_info = { "Collection", 0, 0, 0 };
 // for constructs like document.forms.<name>[1],
 // so it shouldn't be a problem that it's storing all the nodes (with the same name). (David)
 JSNamedNodesCollection::JSNamedNodesCollection(ExecState* exec, const Vector<RefPtr<Node> >& nodes)
-    : DOMObject(getDOMStructure<JSNamedNodesCollection>(exec))
+    // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
+    // we should use the global object from the nodes.
+    : DOMObject(deprecatedGetDOMStructure<JSNamedNodesCollection>(exec))
     , m_nodes(new Vector<RefPtr<Node> >(nodes))
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
index f7c87e2..c430d5f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
@@ -49,7 +49,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSRGBColor);
 const ClassInfo JSRGBColor::s_info = { "RGBColor", 0, &JSRGBColorTable, 0 };
 
 JSRGBColor::JSRGBColor(ExecState* exec, unsigned color)
-    : DOMObject(getDOMStructure<JSRGBColor>(exec))
+    // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
+    // This will be fixed when JSRGBColor wraps css/RGBColor instead of being custom.
+    : DOMObject(deprecatedGetDOMStructure<JSRGBColor>(exec))
     , m_color(color)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
new file mode 100644
index 0000000..ead17dd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSSharedWorkerConstructor.h"
+
+#include "JSDOMWindowCustom.h"
+#include "JSSharedWorker.h"
+#include "SharedWorker.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+const ClassInfo JSSharedWorkerConstructor::s_info = { "SharedWorkerConstructor", 0, 0, 0 };
+
+JSSharedWorkerConstructor::JSSharedWorkerConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMObject(JSSharedWorkerConstructor::createStructure(globalObject->objectPrototype()))
+{
+    putDirect(exec->propertyNames().prototype, JSSharedWorkerPrototype::self(exec, globalObject), None);
+    // Host functions have a length property describing the number of expected arguments.
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructSharedWorker(ExecState* exec, JSObject*, const ArgList& args)
+{
+    if (args.size() < 2)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    UString scriptURL = args.at(0).toString(exec);
+    UString name = args.at(1).toString(exec);
+    if (exec->hadException())
+        return 0;
+
+    ScriptExecutionContext* context = static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject())->scriptExecutionContext();
+    ExceptionCode ec = 0;
+    RefPtr<SharedWorker> worker = SharedWorker::create(scriptURL, name, context, ec);
+    setDOMException(exec, ec);
+
+    // FIXME: toJS() creates an object whose prototype is derived from lexicalGlobalScope, which is incorrect (Bug 27088)
+    return asObject(toJS(exec, worker.release()));
+}
+
+ConstructType JSSharedWorkerConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructSharedWorker;
+    return ConstructTypeHost;
+}
+
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.h
new file mode 100644
index 0000000..be8b2b4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSSharedWorkerConstructor_h
+#define JSSharedWorkerConstructor_h
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class JSSharedWorkerConstructor : public DOMObject {
+    public:
+        JSSharedWorkerConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
+
+#endif // JSSharedWorkerConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
new file mode 100644
index 0000000..8553298
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSSharedWorker.h"
+
+#include "JSDOMGlobalObject.h"
+#include "SharedWorker.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSSharedWorker::mark()
+{
+    Base::mark();
+
+    if (MessagePort* port = impl()->port()) {
+        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
+        if (wrapper && !wrapper->marked())
+            wrapper->mark();
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 14bbe19..06475f9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -30,7 +30,10 @@
 #include "JSWorkerContext.h"
 
 #include "JSDOMBinding.h"
+#include "JSDOMGlobalObject.h"
 #include "JSEventListener.h"
+#include "JSMessageChannelConstructor.h"
+#include "JSMessagePort.h"
 #include "JSWorkerLocation.h"
 #include "JSWorkerNavigator.h"
 #include "JSXMLHttpRequestConstructor.h"
@@ -138,6 +141,14 @@ JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
     return jsNumber(exec, impl()->setInterval(action, delay));
 }
 
+
+#if ENABLE(CHANNEL_MESSAGING)
+JSValue JSWorkerContext::messageChannel(ExecState* exec) const
+{
+    return getDOMConstructor<JSMessageChannelConstructor>(exec, this);
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
index f4d3033..9707519 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -31,6 +31,7 @@
 
 #include "JSDOMGlobalObject.h"
 #include "JSEventListener.h"
+#include "JSMessagePort.h"
 #include "Worker.h"
 
 using namespace JSC;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index 3e59df9..442205e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -81,7 +81,15 @@ ScriptController::~ScriptController()
 
 ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode) 
 {
-    if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
+    const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
+    String sourceURL = jsSourceCode.provider()->url();
+    
+    if (sourceURL.isNull() && !m_XSSAuditor->canEvaluateJavaScriptURL(sourceCode.source())) {
+        // This JavaScript URL is not safe to be evaluated.
+        return JSValue();
+    }
+    
+    if (!sourceURL.isNull() && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return JSValue();
     }
@@ -89,8 +97,6 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     // evaluate code. Returns the JS return value or 0
     // if there was none, an error occured or the type couldn't be converted.
 
-    const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
-
     initScriptIfNeeded();
     // inlineCode is true for <a href="javascript:doSomething()">
     // and false for <script>doSomething()</script>. Check if it has the
@@ -98,7 +104,6 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     // See smart window.open policy for where this is used.
     ExecState* exec = m_windowShell->window()->globalExec();
     const String* savedSourceURL = m_sourceURL;
-    String sourceURL = jsSourceCode.provider()->url();
     m_sourceURL = &sourceURL;
 
     JSLock lock(false);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
index 13e180a..ab392bc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -31,7 +31,6 @@
 #include "config.h"
 #include "ScriptObjectQuarantine.h"
 
-#include "Database.h"
 #include "Document.h"
 #include "Frame.h"
 #include "JSDOMBinding.h"
@@ -43,6 +42,7 @@
 #include <runtime/JSLock.h>
 
 #if ENABLE(DATABASE)
+#include "Database.h"
 #include "JSDatabase.h"
 #endif