Update src/3rdparty/webkit from trunk.

Imported from 839d8709327f925aacb3b6362c06152594def97e
in branch qtwebkit-2.0 of repository
git://gitorious.org/+qtwebkit-developers/webkit/qtwebkit.git

Rubber-stamped-by: Simon Hausmann

175 files changed, 5985 insertions, 3789 deletions

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp
new file mode 100644
index 0000000..bfcab0b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp
@@ -0,0 +1,37 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DOMObjectHashTableMap.h"
+
+#include "WebCoreJSClientData.h"
+
+using namespace JSC;
+
+namespace WebCore{
+
+DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h
new file mode 100644
index 0000000..4ddacb8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h
@@ -0,0 +1,60 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DOMObjectHashTableMap_h
+#define DOMObjectHashTableMap_h
+
+#include <runtime/Lookup.h>
+#include <wtf/HashMap.h>
+
+namespace JSC {
+    class JSGlobalData;
+}
+
+namespace WebCore {
+
+// Map from static HashTable instances to per-GlobalData ones.
+class DOMObjectHashTableMap {
+public:
+    static DOMObjectHashTableMap& mapFor(JSC::JSGlobalData&);
+
+    ~DOMObjectHashTableMap()
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
+        for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
+            iter->second.deleteTable();
+    }
+
+    const JSC::HashTable* get(const JSC::HashTable* staticTable)
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
+        if (iter != m_map.end())
+            return &iter->second;
+        return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
+    }
+
+private:
+    HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
+};
+
+} // namespace WebCore
+
+#endif // DOMObjectHashTableMap_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h
deleted file mode 100644
index 3d435cb..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2009 Google, Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DOMObjectWithSVGContext_h
-#define DOMObjectWithSVGContext_h
-
-#if ENABLE(SVG)
-
-#include "JSDOMBinding.h"
-#include "SVGElement.h"
-
-namespace WebCore {
-
-    // FIXME: This class (and file) should be removed once all SVG bindings
-    // have moved context() onto the various impl() pointers.
-    class DOMObjectWithSVGContext : public DOMObject {
-    public:
-        SVGElement* context() const { return m_context.get(); }
-
-    protected:
-        DOMObjectWithSVGContext(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
-            : DOMObject(structure)
-            , m_context(context)
-        {
-            // No space to store the JSDOMGlobalObject w/o hitting the CELL_SIZE limit.
-        }
-
-    protected: // FIXME: Many custom bindings use m_context directly.  Making this protected to temporariliy reduce code churn.
-        RefPtr<SVGElement> m_context;
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
-#endif // DOMObjectWithSVGContext_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp
new file mode 100644
index 0000000..c696315
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp
@@ -0,0 +1,68 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DOMWrapperWorld.h"
+
+#include "JSDOMWindow.h"
+#include "WebCoreJSClientData.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData, bool isNormal)
+    : m_globalData(globalData)
+    , m_isNormal(isNormal)
+{
+}
+
+static void forgetWorldOfDOMNodesForDocument(Document* document, DOMWrapperWorld* world)
+{
+    Document::JSWrapperCache* wrappers = document->wrapperCacheMap().take(world);
+    ASSERT(wrappers); // 'world' should only know about 'document' if 'document' knows about 'world'!
+    delete wrappers;
+}
+
+DOMWrapperWorld::~DOMWrapperWorld()
+{
+    JSGlobalData::ClientData* clientData = m_globalData->clientData;
+    ASSERT(clientData);
+    static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
+
+    for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
+        forgetWorldOfDOMNodesForDocument(*iter, this);
+}
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->normalWorld();
+}
+
+DOMWrapperWorld* mainThreadNormalWorld()
+{
+    ASSERT(isMainThread());
+    static DOMWrapperWorld* cachedNormalWorld = normalWorld(*JSDOMWindow::commonJSGlobalData());
+    return cachedNormalWorld;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h
new file mode 100644
index 0000000..65cf6a6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h
@@ -0,0 +1,88 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DOMWrapperWorld_h
+#define DOMWrapperWorld_h
+
+#include "Document.h"
+#include "JSDOMGlobalObject.h"
+#include "JSDOMWrapper.h"
+#include <runtime/WeakGCMap.h>
+
+namespace WebCore {
+
+class StringImpl;
+
+typedef JSC::WeakGCMap<void*, DOMObject*> DOMObjectWrapperMap;
+typedef JSC::WeakGCMap<StringImpl*, JSC::JSString*> JSStringCache; 
+
+class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
+public:
+    static PassRefPtr<DOMWrapperWorld> create(JSC::JSGlobalData* globalData, bool isNormal)
+    {
+        return adoptRef(new DOMWrapperWorld(globalData, isNormal));
+    }
+    ~DOMWrapperWorld();
+
+    void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
+    void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
+
+    // FIXME: can we make this private?
+    DOMObjectWrapperMap m_wrappers;
+    JSStringCache m_stringCache;
+
+    bool isNormal() const { return m_isNormal; }
+
+protected:
+    DOMWrapperWorld(JSC::JSGlobalData*, bool isNormal);
+
+private:
+    JSC::JSGlobalData* m_globalData;
+    HashSet<Document*> documentsWithWrappers;
+    bool m_isNormal;
+};
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
+DOMWrapperWorld* mainThreadNormalWorld();
+inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
+inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
+
+inline DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
+{
+    return static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->world();
+}
+
+// From Document.h
+
+inline Document::JSWrapperCache* Document::getWrapperCache(DOMWrapperWorld* world)
+{
+    if (world->isNormal()) {
+        if (Document::JSWrapperCache* wrapperCache = m_normalWorldWrapperCache)
+            return wrapperCache;
+        ASSERT(!m_wrapperCacheMap.contains(world));
+    } else if (Document::JSWrapperCache* wrapperCache = m_wrapperCacheMap.get(world))
+        return wrapperCache;
+    return createWrapperCache(world);
+}
+
+} // namespace WebCore
+
+#endif // DOMWrapperWorld_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
index 59bcfa3..d5a1789 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
@@ -40,17 +40,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-#if USE(PTHREADS)
-
 static void* collect(void*)
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
     return 0;
 }
 
-#endif
-
 GCController& gcController()
 {
     DEFINE_STATIC_LOCAL(GCController, staticGCController, ());
@@ -70,14 +66,14 @@ void GCController::garbageCollectSoon()
 
 void GCController::gcTimerFired(Timer<GCController>*)
 {
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    collect(0);
 }
 
 void GCController::garbageCollectNow()
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    if (!JSDOMWindow::commonJSGlobalData()->heap.isBusy())
+        collect(0);
 }
 
 void GCController::garbageCollectOnAlternateThreadForDebugging(bool waitUntilDone)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 6eca7bd..61fcf98 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -50,7 +50,7 @@ JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -60,7 +60,7 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index 14457c4..3c01535 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -65,10 +65,8 @@ void JSAttr::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->ownerElement()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->ownerElement())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
index 174cc11..77bb120 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -30,10 +30,7 @@
 #include "JSAudioConstructor.h"
 
 #include "HTMLAudioElement.h"
-#include "HTMLNames.h"
 #include "JSHTMLAudioElement.h"
-#include "ScriptExecutionContext.h"
-#include "Text.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -46,24 +43,30 @@ JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globa
     : DOMConstructorWithDocument(JSAudioConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
     putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontDelete | DontEnum);
 }
 
 static JSObject* constructAudio(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSAudioConstructor* jsAudio = static_cast<JSAudioConstructor*>(constructor);
-    // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
-    Document* document = jsAudio->document();
+    JSAudioConstructor* jsConstructor = static_cast<JSAudioConstructor*>(constructor);
+
+    Document* document = jsConstructor->document();
     if (!document)
         return throwError(exec, ReferenceError, "Audio constructor associated document is unavailable");
 
-    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
-    audio->setAutobuffer(true);
-    if (args.size() > 0) {
-        audio->setSrc(args.at(0).toString(exec));
-        audio->scheduleLoad();
-    }
-    return asObject(toJS(exec, jsAudio->globalObject(), audio.release()));
+    // Calling toJS on the document causes the JS document wrapper to be
+    // added to the window object. This is done to ensure that JSDocument::markChildren
+    // will be called, which will cause the audio element to be marked if necessary.
+    toJS(exec, jsConstructor->globalObject(), document);
+
+    // FIXME: This converts an undefined argument to the string "undefined", but possibly we
+    // should treat it as if no argument was passed instead, by checking the value of args.at
+    // rather than looking at args.size.
+    String src;
+    if (args.size() > 0)
+        src = args.at(0).toString(exec);
+    return asObject(toJS(exec, jsConstructor->globalObject(),
+        HTMLAudioElement::createForJSConstructor(document, src)));
 }
 
 ConstructType JSAudioConstructor::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
index f08303a..5a0820b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -85,8 +85,8 @@
 #include "JSHistoryCustom.cpp"
 #include "JSImageConstructor.cpp"
 #include "JSImageDataCustom.cpp"
-#include "JSInspectedObjectWrapper.cpp"
-#include "JSInspectorBackendCustom.cpp"
+#include "JSInjectedScriptHostCustom.cpp"
+#include "JSInspectorFrontendHostCustom.cpp"
 #include "JSJavaScriptCallFrameCustom.cpp"
 #include "JSLazyEventListener.cpp"
 #include "JSLocationCustom.cpp"
@@ -106,7 +106,6 @@
 #include "JSPluginArrayCustom.cpp"
 #include "JSPluginCustom.cpp"
 #include "JSPluginElementFunctions.cpp"
-#include "JSQuarantinedObjectWrapper.cpp"
 #include "JSSQLResultSetRowListCustom.cpp"
 #include "JSSQLTransactionCustom.cpp"
 #include "JSSVGElementInstanceCustom.cpp"
@@ -114,7 +113,6 @@
 #include "JSSVGMatrixCustom.cpp"
 #include "JSSVGPathSegCustom.cpp"
 #include "JSSVGPathSegListCustom.cpp"
-#include "JSSVGPointListCustom.cpp"
 #include "JSSharedWorkerConstructor.cpp"
 #include "JSSharedWorkerCustom.cpp"
 #include "JSStorageCustom.cpp"
@@ -142,9 +140,10 @@
 #include "ScriptCallStack.cpp"
 #include "ScriptController.cpp"
 #include "ScriptControllerWin.cpp"
+#include "ScriptDebugServer.cpp"
 #include "ScriptEventListener.cpp"
 #include "ScriptFunctionCall.cpp"
-#include "ScriptObjectQuarantine.cpp"
+#include "ScriptProfiler.cpp"
 #include "ScriptState.cpp"
 #include "SerializedScriptValue.cpp"
 #include "WorkerScriptController.cpp"
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 1b96c06..b0adf15 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -54,7 +54,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSRule* rule)
     if (!rule)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), rule);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, rule);
     if (wrapper)
         return wrapper;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 4a137d3..fad7aba 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -142,9 +142,9 @@ bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*,
 
 // FIXME: You can get these properties, and set them (see putDelegate below),
 // but you should also be able to enumerate them.
-JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
 
     // Set up pixelOrPos boolean to handle the fact that
     // pixelTop returns "CSS Top" as number value in unit pixels
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
index 87a5760..83c1d3a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -49,7 +49,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSValue* value)
     if (!value)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), value);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, value);
 
     if (wrapper)
         return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
index 38292c7..e128f27 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
@@ -47,13 +47,8 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     ASSERT(globalObject());
 
     ExecState* exec = globalObject()->globalExec();
-    
-    JSValue function;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        function = callback()->get(exec, Identifier(exec, "handleEvent"));
-    }
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -64,7 +59,7 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     }
     
     globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = callInWorld(exec, function, callType, callData, callback(), args, m_isolatedWorld.get());
+    JSValue result = JSC::call(exec, function, callType, callData, callback(), args);
     globalObject()->globalData()->timeoutChecker.stop();
 
     Document::updateStyleForAllDocuments();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
index 5c86701..b939c01 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
@@ -48,7 +48,6 @@ public:
     JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
         : m_callback(callback)
         , m_globalObject(globalObject)
-        , m_isolatedWorld(currentWorld(globalObject->globalExec()))
     {
     }
     
@@ -65,7 +64,6 @@ public:
 private:
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
     JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-    RefPtr<DOMWrapperWorld> m_isolatedWorld;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
deleted file mode 100644
index 14548d7..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "config.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasByteArray.h"
-#include "JSCanvasUnsignedByteArray.h"
-#include "JSCanvasShortArray.h"
-#include "JSCanvasUnsignedShortArray.h"
-#include "JSCanvasIntArray.h"
-#include "JSCanvasUnsignedIntArray.h"
-#include "JSCanvasFloatArray.h"
-
-#include "CanvasArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
-{
-    if (object->isFloatArray())
-        return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, static_cast<CanvasFloatArray*>(object));
-    if (object->isUnsignedByteArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, static_cast<CanvasUnsignedByteArray*>(object));
-    if (object->isByteArray())
-        return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, static_cast<CanvasByteArray*>(object));
-    if (object->isIntArray())
-        return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, static_cast<CanvasIntArray*>(object));
-    if (object->isUnsignedIntArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, static_cast<CanvasUnsignedIntArray*>(object));
-    if (object->isShortArray())
-        return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, static_cast<CanvasShortArray*>(object));
-    if (object->isUnsignedShortArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, static_cast<CanvasUnsignedShortArray*>(object));
-    return jsUndefined();
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index bb3500b..a271923 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -51,10 +51,10 @@ static JSValue toJS(ExecState* exec, CanvasStyle* style)
     return jsString(exec, style->color());
 }
 
-static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState* exec, JSValue value)
 {
     if (value.isString())
-        return CanvasStyle::create(asString(value)->value());
+        return CanvasStyle::create(asString(value)->value(exec));
     if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
@@ -102,13 +102,13 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value());
+                context->setFillColor(asString(args.at(0))->value(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setFillColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -139,13 +139,13 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value());
+                context->setStrokeColor(asString(args.at(0))->value(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setStrokeColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -298,7 +298,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 4:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value());
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec));
@@ -306,7 +306,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 5:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value(),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec),
                                    args.at(4).toFloat(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
deleted file mode 100644
index 3938ba1..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
+++ /dev/null
@@ -1,443 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasRenderingContext3D.h"
-
-#include "CanvasRenderingContext3D.h"
-#include "ExceptionCode.h"
-#include "HTMLCanvasElement.h"
-#include "HTMLImageElement.h"
-#include "JSCanvasFloatArray.h"
-#include "JSCanvasIntArray.h"
-#include "JSHTMLCanvasElement.h"
-#include "JSHTMLImageElement.h"
-#include "JSWebKitCSSMatrix.h"
-#include <runtime/Error.h>
-#include <wtf/FastMalloc.h>
-#include <wtf/OwnFastMallocPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned usage = args.at(2).toInt32(exec);
-
-    // If argument 1 is a number, we are initializing this buffer to that size
-    if (!args.at(1).isObject()) {
-        unsigned int count = args.at(1).toInt32(exec);
-        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
-        return jsUndefined();
-    }
-
-    CanvasArray* array = toCanvasArray(args.at(1));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
-    return jsUndefined();
-}
-
-JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned offset = args.at(1).toInt32(exec);
-    
-    CanvasArray* array = toCanvasArray(args.at(2));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
-    return jsUndefined();
-}
-
-// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 3)
-        return throwError(exec, SyntaxError);
-
-    ExceptionCode ec = 0;
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    unsigned level = args.at(1).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-    
-    if (args.size() > 5) {
-        // This must be the bare array case.
-        if (args.size() != 9)
-            return throwError(exec, SyntaxError);
-            
-        unsigned internalformat = args.at(2).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned width = args.at(3).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned height = args.at(4).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned border = args.at(5).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned format = args.at(6).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned type = args.at(7).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        CanvasArray* array = toCanvasArray(args.at(8));
-        if (exec->hadException())    
-            return jsUndefined();
-            
-        if (!array)
-            return throwError(exec, TypeError);
-        
-        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
-        // depending on the passed type parameter.
-        
-        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
-        return jsUndefined();
-    }
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(2);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 7 || args.size() > 9)
-        return throwError(exec, SyntaxError);
-
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned level = args.at(1).toInt32(exec);
-    unsigned xoff = args.at(2).toInt32(exec);
-    unsigned yoff = args.at(3).toInt32(exec);
-    unsigned width = args.at(4).toInt32(exec);
-    unsigned height = args.at(5).toInt32(exec);
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(6);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    ExceptionCode ec = 0;
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-template<typename T>
-void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
-{
-    array = 0;
-    
-    if (!value.isObject())
-        return;
-        
-    JSC::JSObject* object = asObject(value);
-    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
-    void* tempValues;
-    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
-        return;
-    
-    T* values = static_cast<T*>(tempValues);
-    for (int i = 0; i < length; ++i) {
-        JSC::JSValue v = object->get(exec, i);
-        if (exec->hadException())
-            return;
-        values[i] = static_cast<T>(v.toNumber(exec));
-    }
-
-    array = values;
-    size = length;
-}
-
-enum DataFunctionToCall {
-    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
-    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
-};
-
-enum DataFunctionMatrixToCall {
-    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
-};
-
-static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
-            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
-            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
-            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
-            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1fv(location, array, size); break;
-        case f_uniform2v: context->uniform2fv(location, array, size); break;
-        case f_uniform3v: context->uniform3fv(location, array, size); break;
-        case f_uniform4v: context->uniform4fv(location, array, size); break;
-        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
-        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
-        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
-        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
-            default: break;
-        }
-        return jsUndefined();
-    }
-    
-    int* array;
-    int size;
-    toArray<int>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1iv(location, array, size); break;
-        case f_uniform2v: context->uniform2iv(location, array, size); break;
-        case f_uniform3v: context->uniform3iv(location, array, size); break;
-        case f_uniform4v: context->uniform4iv(location, array, size); break;
-        default: break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    bool transpose = args.at(1).toBoolean(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(2), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
-        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
-        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
-    }
-    return jsUndefined();
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
index 0cd2aa3..df24eb7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -29,8 +29,8 @@
 #include "CanvasRenderingContext2D.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "CanvasRenderingContext3D.h"
-#include "JSCanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 
 using namespace JSC;
@@ -44,7 +44,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasR
 
 #if ENABLE(3D_CANVAS)
     if (object->is3d())
-        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+        return getDOMObjectWrapper<JSWebGLRenderingContext>(exec, globalObject, static_cast<WebGLRenderingContext*>(object));
 #endif
     ASSERT(object->is2d());
     return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
deleted file mode 100644
index 23c197f..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasUnsignedShortArrayConstructor_h
-#define JSCanvasUnsignedShortArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
index 9c48467..b631cdd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -24,11 +24,13 @@
  */
 
 #include "config.h"
+
 #include "JSConsole.h"
-#include "JavaScriptProfile.h"
-#include <runtime/JSArray.h>
 
 #include "Console.h"
+#include "JavaScriptProfile.h"
+#include "ScriptCallStack.h"
+#include <runtime/JSArray.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index e5f83aa..cc6d45c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionCallback.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "Frame.h"
 #include "JSGeoposition.h"
 #include "ScriptController.h"
@@ -52,3 +54,5 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index bd64deb..c94ae9a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionErrorCallback.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "Frame.h"
 #include "JSPositionError.h"
 #include "ScriptController.h"
@@ -53,3 +55,5 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 }
     
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 6178509..4d5de79 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -77,7 +77,7 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         // Therefore an exception and returning true are the same thing - so, return true on an exception
         return true;
     }
-    return result.toBoolean(exec);
+    return !result.isFalse();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index c2884d7..07cfc74 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -90,7 +90,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     args.append(jsString(exec, prefix));
 
     m_globalObject->globalData()->timeoutChecker.start();
-    JSValue retval = callInWorld(exec, function, callType, callData, m_customResolver, args, currentWorld(m_globalObject->globalExec()));
+    JSValue retval = JSC::call(exec, function, callType, callData, m_customResolver, args);
     m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 91ee51a..5637087 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -91,7 +91,7 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -101,7 +101,7 @@ JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgLis
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index ef69c7b..f294dad 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -25,6 +25,7 @@
 
 #include "ActiveDOMObject.h"
 #include "DOMCoreException.h"
+#include "DOMObjectHashTableMap.h"
 #include "Document.h"
 #include "EventException.h"
 #include "ExceptionBase.h"
@@ -33,10 +34,11 @@
 #include "HTMLAudioElement.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
-#include "HTMLScriptElement.h"
 #include "HTMLNames.h"
+#include "HTMLScriptElement.h"
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
+#include "JSDebugWrapperSet.h"
 #include "JSEventException.h"
 #include "JSExceptionBase.h"
 #include "JSNode.h"
@@ -45,12 +47,16 @@
 #include "KURL.h"
 #include "MessagePort.h"
 #include "RangeException.h"
+#include "ScriptCachedFrameData.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "WebCoreJSClientData.h"
 #include "XMLHttpRequestException.h"
+#include <runtime/DateInstance.h>
 #include <runtime/Error.h>
 #include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
+#include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(SVG)
@@ -63,11 +69,6 @@
 #include "XPathException.h"
 #endif
 
-#if ENABLE(WORKERS)
-#include <wtf/ThreadSpecific.h>
-using namespace WTF;
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
@@ -77,121 +78,6 @@ using namespace HTMLNames;
 typedef Document::JSWrapperCache JSWrapperCache;
 typedef Document::JSWrapperCacheMap JSWrapperCacheMap;
 
-// For debugging, keep a set of wrappers currently registered, and check that
-// all are unregistered before they are destroyed. This has helped us fix at
-// least one bug.
-
-static void addWrapper(DOMObject* wrapper);
-static void removeWrapper(DOMObject* wrapper);
-static void removeWrappers(const JSWrapperCache& wrappers);
-static void removeWrappers(const DOMObjectWrapperMap& wrappers);
-
-#ifdef NDEBUG
-
-static inline void addWrapper(DOMObject*)
-{
-}
-
-static inline void removeWrapper(DOMObject*)
-{
-}
-
-static inline void removeWrappers(const JSWrapperCache&)
-{
-}
-
-static inline void removeWrappers(const DOMObjectWrapperMap&)
-{
-}
-
-#else
-
-static HashSet<DOMObject*>& wrapperSet()
-{
-#if ENABLE(WORKERS)
-    DEFINE_STATIC_LOCAL(ThreadSpecific<HashSet<DOMObject*> >, staticWrapperSet, ());
-    return *staticWrapperSet;
-#else
-    DEFINE_STATIC_LOCAL(HashSet<DOMObject*>, staticWrapperSet, ());
-    return staticWrapperSet;
-#endif
-}
-
-static void addWrapper(DOMObject* wrapper)
-{
-    ASSERT(!wrapperSet().contains(wrapper));
-    wrapperSet().add(wrapper);
-}
-
-static void removeWrapper(DOMObject* wrapper)
-{
-    if (!wrapper)
-        return;
-    ASSERT(wrapperSet().contains(wrapper));
-    wrapperSet().remove(wrapper);
-}
-
-static void removeWrappers(const JSWrapperCache& wrappers)
-{
-    JSWrapperCache::const_iterator wrappersEnd = wrappers.end();
-    for (JSWrapperCache::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
-        removeWrapper(it->second);
-}
-
-static inline void removeWrappers(const DOMObjectWrapperMap& wrappers)
-{
-    DOMObjectWrapperMap::const_iterator wrappersEnd = wrappers.end();
-    for (DOMObjectWrapperMap::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
-        removeWrapper(it->second);
-}
-
-DOMObject::~DOMObject()
-{
-    ASSERT(!wrapperSet().contains(this));
-}
-
-#endif
-
-DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData)
-    : m_globalData(globalData)
-{
-}
-
-DOMWrapperWorld::~DOMWrapperWorld()
-{
-    JSGlobalData::ClientData* clientData = m_globalData->clientData;
-    ASSERT(clientData);
-    static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
-
-    removeWrappers(m_wrappers);
-
-    for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
-        forgetWorldOfDOMNodesForDocument(*iter, this);
-    for (HashSet<ScriptController*>::iterator iter = scriptControllersWithShells.begin(); iter != scriptControllersWithShells.end(); ++iter)
-        (*iter)->forgetWorld(this);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::JSGlobalData& globalData, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::ExecState* exec, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = exec->globalData().clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::~EnterDOMWrapperWorld()
-{
-    m_clientData->m_worldStack.removeLast();
-}
-
 class JSGlobalDataWorldIterator {
 public:
     JSGlobalDataWorldIterator(JSGlobalData* globalData)
@@ -228,124 +114,105 @@ private:
     HashSet<DOMWrapperWorld*>::iterator m_end;
 };
 
-static inline DOMWrapperWorld* currentWorld(JSC::JSGlobalData& globalData)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
-}
-
-DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
-{
-    return currentWorld(exec->globalData());
-}
-
-DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->normalWorld();
-}
-
-DOMWrapperWorld* mainThreadNormalWorld()
-{
-    ASSERT(isMainThread());
-    return normalWorld(*JSDOMWindow::commonJSGlobalData());
-}
-
-DOMWrapperWorld* mainThreadCurrentWorld()
+const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const JSC::HashTable* staticTable)
 {
-    ASSERT(isMainThread());
-
-    JSGlobalData::ClientData* clientData = JSDOMWindowBase::commonJSGlobalData()->clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
+    return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
 }
 
-DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
+bool hasCachedDOMObjectWrapperUnchecked(JSGlobalData* globalData, void* objectHandle)
 {
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.uncheckedGet(objectHandle))
+            return true;
+    }
+    return false;
 }
 
-const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const JSC::HashTable* staticTable)
+bool hasCachedDOMObjectWrapper(JSGlobalData* globalData, void* objectHandle)
 {
-    return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.get(objectHandle))
+            return true;
+    }
+    return false;
 }
 
-//inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
-inline DOMObjectWrapperMap& DOMObjectWrapperMapFor(JSGlobalData& globalData)
+DOMObject* getCachedDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle) 
 {
-    return currentWorld(globalData)->m_wrappers;
+    return domObjectWrapperMapFor(exec).get(objectHandle);
 }
 
-DOMObject* getCachedDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle) 
+void cacheDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle, DOMObject* wrapper) 
 {
-    return DOMObjectWrapperMapFor(globalData).get(objectHandle);
+    JSDebugWrapperSet::willCacheWrapper(wrapper);
+    domObjectWrapperMapFor(exec).set(objectHandle, wrapper);
 }
 
-void cacheDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle, DOMObject* wrapper) 
+bool hasCachedDOMNodeWrapperUnchecked(Document* document, Node* node)
 {
-    addWrapper(wrapper);
-    DOMObjectWrapperMapFor(globalData).set(objectHandle, wrapper);
-}
+    if (!document)
+        return hasCachedDOMObjectWrapperUnchecked(JSDOMWindow::commonJSGlobalData(), node);
 
-JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
-{
-    if (document)
-        return document->getWrapperCache(mainThreadCurrentWorld())->get(node);
-    return static_cast<JSNode*>(DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+        if (iter->second->uncheckedGet(node))
+            return true;
+    }
+    return false;
 }
 
 void forgetDOMObject(DOMObject* wrapper, void* objectHandle)
 {
     JSC::JSGlobalData* globalData = Heap::heap(wrapper)->globalData();
-    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
-        DOMObjectWrapperMap& wrappers = worldIter->m_wrappers;
-        DOMObjectWrapperMap::iterator iter = wrappers.find(objectHandle);
-        if ((iter != wrappers.end()) && (iter->second == wrapper)) {
-            removeWrapper(wrapper);
-            wrappers.remove(iter);
-            return;
-        }
+
+    // Check the normal world first!
+    JSGlobalData::ClientData* clientData = globalData->clientData;
+    ASSERT(clientData);
+    DOMObjectWrapperMap& wrappers = static_cast<WebCoreJSClientData*>(clientData)->normalWorld()->m_wrappers;
+    if (wrappers.uncheckedRemove(objectHandle, wrapper)) {
+        JSDebugWrapperSet::didUncacheWrapper(wrapper);
+        return;
     }
 
-    // If the world went away, it should have removed this wrapper from the set.
-    ASSERT(!wrapperSet().contains(wrapper));
+    // We can't guarantee that a wrapper is in the cache when it uncaches itself,
+    // since a new wrapper may be cached before the old wrapper's destructor runs.
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.uncheckedRemove(objectHandle, wrapper))
+            break;
+    }
+    JSDebugWrapperSet::didUncacheWrapper(wrapper);
 }
 
-void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document)
+void forgetDOMNode(JSNode* wrapper, Node* node, Document* document)
 {
+    node->clearWrapper(wrapper);
+
     if (!document) {
         forgetDOMObject(wrapper, node);
         return;
     }
 
+    // We can't guarantee that a wrapper is in the cache when it uncaches itself,
+    // since a new wrapper may be cached before the old wrapper's destructor runs.
     JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
     for (JSWrapperCacheMap::iterator wrappersIter = wrapperCacheMap.begin(); wrappersIter != wrapperCacheMap.end(); ++wrappersIter) {
-        JSWrapperCache* wrappers = wrappersIter->second;
-        JSWrapperCache::iterator iter = wrappers->find(node);
-        if ((iter != wrappers->end()) && (iter->second == wrapper)) {
-            wrappers->remove(iter);
-            removeWrapper(wrapper);
-            return;
-        }
+        if (wrappersIter->second->uncheckedRemove(node, wrapper))
+            break;
     }
-
-    // If the world went away, it should have removed this wrapper from the set.
-    ASSERT(!wrapperSet().contains(wrapper));
+    JSDebugWrapperSet::didUncacheWrapper(wrapper);
 }
 
-void cacheDOMNodeWrapper(Document* document, Node* node, JSNode* wrapper)
+void cacheDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node, JSNode* wrapper)
 {
-    if (!document) {
-        addWrapper(wrapper);
-        DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
-        return;
-    }
-    addWrapper(wrapper);
-    document->getWrapperCache(mainThreadCurrentWorld())->set(node, wrapper);
+    JSDebugWrapperSet::willCacheWrapper(wrapper);
+
+    if (!document)
+        domObjectWrapperMapFor(exec).set(node, wrapper);
+    else
+        document->getWrapperCache(currentWorld(exec))->set(node, wrapper);
+
+    if (currentWorld(exec)->isNormal())
+        node->setWrapper(wrapper);
 }
 
 void forgetAllDOMNodesForDocument(Document* document)
@@ -354,21 +221,11 @@ void forgetAllDOMNodesForDocument(Document* document)
     JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
     JSWrapperCacheMap::const_iterator wrappersMapEnd = wrapperCacheMap.end();
     for (JSWrapperCacheMap::const_iterator wrappersMapIter = wrapperCacheMap.begin(); wrappersMapIter != wrappersMapEnd; ++wrappersMapIter) {
-        JSWrapperCache* wrappers = wrappersMapIter->second;
-        removeWrappers(*wrappers);
-        delete wrappers;
+        delete wrappersMapIter->second;
         wrappersMapIter->first->forgetDocument(document);
     }
 }
 
-void forgetWorldOfDOMNodesForDocument(Document* document, DOMWrapperWorld* world)
-{
-    JSWrapperCache* wrappers = document->wrapperCacheMap().take(world);
-    ASSERT(wrappers); // 'world' should only know about 'document' if 'document' knows about 'world'!
-    removeWrappers(*wrappers);
-    delete wrappers;
-}
-
 static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world)
 {
     // Certain conditions implicitly make a JS DOM node wrapper observable
@@ -395,14 +252,14 @@ static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world
         // the custom markChildren functions rather than here.
         if (node->isElementNode()) {
             if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
-                if (DOMObject* wrapper = world->m_wrappers.get(attributes)) {
+                if (DOMObject* wrapper = world->m_wrappers.uncheckedGet(attributes)) {
                     if (wrapper->hasCustomProperties())
                         return true;
                 }
             }
             if (node->isStyledElement()) {
                 if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
-                    if (DOMObject* wrapper = world->m_wrappers.get(style)) {
+                    if (DOMObject* wrapper = world->m_wrappers.uncheckedGet(style)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -410,7 +267,7 @@ static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world
             }
             if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
                 if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
-                    if (DOMObject* wrapper = world->m_wrappers.get(context)) {
+                    if (DOMObject* wrapper = world->m_wrappers.uncheckedGet(context)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -448,8 +305,8 @@ void markDOMNodesForDocument(MarkStack& markStack, Document* document)
         DOMWrapperWorld* world = wrappersIter->first;
         JSWrapperCache* nodeDict = wrappersIter->second;
 
-        JSWrapperCache::iterator nodeEnd = nodeDict->end();
-        for (JSWrapperCache::iterator nodeIt = nodeDict->begin(); nodeIt != nodeEnd; ++nodeIt) {
+        JSWrapperCache::iterator nodeEnd = nodeDict->uncheckedEnd();
+        for (JSWrapperCache::iterator nodeIt = nodeDict->uncheckedBegin(); nodeIt != nodeEnd; ++nodeIt) {
             JSNode* jsNode = nodeIt->second;
             if (isObservableThroughDOM(jsNode, world))
                 markStack.append(jsNode);
@@ -467,8 +324,7 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
     for (HashMap<ActiveDOMObject*, void*>::const_iterator iter = activeObjects.begin(); iter != activeObjectsEnd; ++iter) {
         if (iter->first->hasPendingActivity()) {
             // Generally, an active object with pending activity must have a wrapper to mark its listeners.
-            // However, some ActiveDOMObjects don't have JS wrappers (timers created by setTimeout is one example).
-            // FIXME: perhaps need to make sure even timers have a markable 'wrapper'.
+            // However, some ActiveDOMObjects don't have JS wrappers.
             markDOMObjectWrapper(markStack, globalData, iter->second);
         }
     }
@@ -491,7 +347,7 @@ static inline void takeWrappers(Node* node, Document* document, WrapperSet& wrap
         JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
         for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
             if (JSNode* wrapper = iter->second->take(node)) {
-                removeWrapper(wrapper);
+                JSDebugWrapperSet::didUncacheWrapper(wrapper);
                 wrapperSet.append(WrapperAndWorld(wrapper, iter->first));
             }
         }
@@ -499,7 +355,7 @@ static inline void takeWrappers(Node* node, Document* document, WrapperSet& wrap
         for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
             DOMWrapperWorld* world = *worldIter;
             if (JSNode* wrapper = static_cast<JSNode*>(world->m_wrappers.take(node))) {
-                removeWrapper(wrapper);
+                JSDebugWrapperSet::didUncacheWrapper(wrapper);
                 wrapperSet.append(WrapperAndWorld(wrapper, world));
             }
         }
@@ -515,11 +371,11 @@ void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocum
 
     for (unsigned i = 0; i < wrapperSet.size(); ++i) {
         JSNode* wrapper = wrapperSet[i].first;
+        JSDebugWrapperSet::willCacheWrapper(wrapper);
         if (newDocument)
             newDocument->getWrapperCache(wrapperSet[i].second)->set(node, wrapper);
         else
             wrapperSet[i].second->m_wrappers.set(node, wrapper);
-        addWrapper(wrapper);
     }
 }
 
@@ -532,11 +388,65 @@ void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void*
         return;
 
     for (JSGlobalDataWorldIterator worldIter(&globalData); worldIter; ++worldIter) {
-        if (DOMObject* wrapper = worldIter->m_wrappers.get(object))
+        if (DOMObject* wrapper = worldIter->m_wrappers.uncheckedGet(object))
+            markStack.append(wrapper);
+    }
+}
+
+void markDOMNodeWrapper(MarkStack& markStack, Document* document, Node* node)
+{
+    if (document) {
+        JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+        for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+            if (JSNode* wrapper = iter->second->uncheckedGet(node))
+                markStack.append(wrapper);
+        }
+        return;
+    }
+
+    for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
+        if (DOMObject* wrapper = worldIter->m_wrappers.uncheckedGet(node))
             markStack.append(wrapper);
     }
 }
 
+static void stringWrapperDestroyed(JSString* str, void* context)
+{
+    StringImpl* cacheKey = static_cast<StringImpl*>(context);
+    JSC::JSGlobalData* globalData = Heap::heap(str)->globalData();
+
+    // Check the normal world first!
+    JSGlobalData::ClientData* clientData = globalData->clientData;
+    ASSERT(clientData);
+    JSStringCache& cache = static_cast<WebCoreJSClientData*>(clientData)->normalWorld()->m_stringCache;
+    if (cache.uncheckedRemove(cacheKey, str)) {
+        cacheKey->deref();
+        return;
+    }
+
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_stringCache.uncheckedRemove(cacheKey, str))
+            break;
+    }
+
+    cacheKey->deref();
+}
+
+JSValue jsStringSlowCase(ExecState* exec, JSStringCache& stringCache, StringImpl* stringImpl)
+{
+    // If there is a stale entry, we have to explicitly remove it to avoid
+    // problems down the line.
+    if (JSString* wrapper = stringCache.uncheckedGet(stringImpl))
+        stringCache.uncheckedRemove(stringImpl, wrapper);
+
+    JSString* wrapper = jsStringWithFinalizer(exec, stringImpl->ustring(), stringWrapperDestroyed, stringImpl);
+    stringCache.set(stringImpl, wrapper);
+    // ref explicitly instead of using a RefPtr-keyed hashtable because the wrapper can
+    // outlive the cache, so the stringImpl has to match the wrapper's lifetime.
+    stringImpl->ref();
+    return wrapper;
+}
+
 JSValue jsStringOrNull(ExecState* exec, const String& s)
 {
     if (s.isNull())
@@ -565,6 +475,11 @@ JSValue jsStringOrFalse(ExecState* exec, const String& s)
     return jsString(exec, s);
 }
 
+JSValue jsString(ExecState* exec, const KURL& url)
+{
+    return jsString(exec, url.string());
+}
+
 JSValue jsStringOrNull(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
@@ -600,6 +515,22 @@ UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValue value)
     return value.toString(exec);
 }
 
+JSValue jsDateOrNull(ExecState* exec, double value)
+{
+    if (!isfinite(value))
+        return jsNull();
+    return new (exec) DateInstance(exec, value);
+}
+
+double valueToDate(ExecState* exec, JSValue value)
+{
+    if (value.isNumber())
+        return value.uncheckedGetNumber();
+    if (!value.inherits(&DateInstance::info))
+        return std::numeric_limits<double>::quiet_NaN();
+    return static_cast<DateInstance*>(value.toObject(exec))->internalNumber();
+}
+
 void reportException(ExecState* exec, JSValue exception)
 {
     UString errorMessage = exception.toString(exec);
@@ -658,7 +589,7 @@ void setDOMException(ExecState* exec, ExceptionCode ec)
             break;
 #if ENABLE(SVG)
         case SVGExceptionType:
-            errorObject = toJS(exec, globalObject, SVGException::create(description).get(), 0);
+            errorObject = toJS(exec, globalObject, SVGException::create(description).get(), 0 /* no context on purpose */);
             break;
 #endif
 #if ENABLE(XPATH)
@@ -728,19 +659,19 @@ Frame* toDynamicFrame(ExecState* exec)
 bool processingUserGesture(ExecState* exec)
 {
     Frame* frame = toDynamicFrame(exec);
-    return frame && frame->script()->processingUserGesture();
+    return frame && frame->script()->processingUserGesture(currentWorld(exec));
 }
 
 KURL completeURL(ExecState* exec, const String& relativeURL)
 {
-    // For histoical reasons, we need to complete the URL using the dynamic frame.
+    // For historical reasons, we need to complete the URL using the dynamic frame.
     Frame* frame = toDynamicFrame(exec);
     if (!frame)
         return KURL();
     return frame->loader()->completeURL(relativeURL);
 }
 
-JSValue objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+JSValue objectToStringFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, objectProtoFuncToString);
 }
@@ -804,34 +735,4 @@ JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
     return object;
 }
 
-bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
-{
-    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
-    return false;
-}
-
-JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const UString& script, JSValue& exception)
-{
-    EnterDOMWrapperWorld worldEntry(debuggerCallFrame.dynamicGlobalObject()->globalExec(), debuggerWorld());
-    return debuggerCallFrame.evaluate(script, exception);
-}
-
-JSValue callInWorld(ExecState* exec, JSValue function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::call(exec, function, callType, callData, thisValue, args);
-}
-
-JSObject* constructInWorld(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::construct(exec, object, constructType, constructData, args);
-}
-
-Completion evaluateInWorld(ExecState* exec, ScopeChain& scopeChain, const SourceCode& sourceCode, JSValue thisValue, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::evaluate(exec, scopeChain, sourceCode, thisValue);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index ba41d85..219472b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -23,9 +23,13 @@
 #define JSDOMBinding_h
 
 #include "JSDOMGlobalObject.h"
-#include "Document.h" // For DOMConstructorWithDocument
+#include "JSDOMWrapper.h"
+#include "DOMWrapperWorld.h"
+#include "JSSVGContextCache.h"
+#include "Document.h"
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
+#include <runtime/WeakGCMap.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -42,6 +46,7 @@ namespace WebCore {
     class Node;
     class String;
     class ScriptController;
+    class ScriptCachedFrameData;
 
     typedef int ExceptionCode;
 
@@ -49,60 +54,37 @@ namespace WebCore {
     class SVGElement;
 #endif
 
-    // Base class for all objects in this binding except Window.
-    class DOMObject : public JSC::JSObject {
-    protected:
-        explicit DOMObject(NonNullPassRefPtr<JSC::Structure> structure) 
-            : JSObject(structure)
-        {
-        }
-
-        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
-
-#ifndef NDEBUG
-        virtual ~DOMObject();
-#endif
-    };
-
     // FIXME: This class should collapse into DOMObject once all DOMObjects are
     // updated to store a globalObject pointer.
     class DOMObjectWithGlobalPointer : public DOMObject {
     public:
-        JSDOMGlobalObject* globalObject() const { return m_globalObject; }
+        JSDOMGlobalObject* globalObject() const { return static_cast<JSDOMGlobalObject*>(getAnonymousValue(GlobalObjectSlot).asCell()); }
 
         ScriptExecutionContext* scriptExecutionContext() const
         {
             // FIXME: Should never be 0, but can be due to bug 27640.
-            return m_globalObject->scriptExecutionContext();
+            return globalObject()->scriptExecutionContext();
         }
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
-        static const unsigned StructureFlags = JSC::OverridesMarkChildren | DOMObject::StructureFlags;
+        static const unsigned AnonymousSlotCount = 1 + DOMObject::AnonymousSlotCount;
+        static const unsigned GlobalObjectSlot = AnonymousSlotCount - 1;
 
         DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
-            , m_globalObject(globalObject)
         {
             // FIXME: This ASSERT is valid, but fires in fast/dom/gc-6.html when trying to create
             // new JavaScript objects on detached windows due to DOMWindow::document()
             // needing to reach through the frame to get to the Document*.  See bug 27640.
             // ASSERT(globalObject->scriptExecutionContext());
+            putAnonymousValue(GlobalObjectSlot, globalObject);
         }
         virtual ~DOMObjectWithGlobalPointer() { }
-
-        void markChildren(JSC::MarkStack& markStack)
-        {
-            DOMObject::markChildren(markStack);
-            markStack.append(m_globalObject);
-        }
-
-    private:
-        JSDOMGlobalObject* m_globalObject;
     };
 
     // Base class for all constructor objects in the JSC bindings.
@@ -110,7 +92,7 @@ namespace WebCore {
     public:
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
@@ -138,121 +120,29 @@ namespace WebCore {
         }
     };
 
-    typedef HashMap<void*, DOMObject*> DOMObjectWrapperMap;
-
-    class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
-    public:
-        DOMWrapperWorld(JSC::JSGlobalData*);
-        ~DOMWrapperWorld();
-
-        void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
-        void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
-        void rememberScriptController(ScriptController* scriptController) { scriptControllersWithShells.add(scriptController); }
-        void forgetScriptController(ScriptController* scriptController) { scriptControllersWithShells.remove(scriptController); }
-
-        // FIXME: can we make this private?
-        DOMObjectWrapperMap m_wrappers;
-
-    private:
-        JSC::JSGlobalData* m_globalData;
-        HashSet<Document*> documentsWithWrappers;
-        HashSet<ScriptController*> scriptControllersWithShells;
-    };
-
-    // Map from static HashTable instances to per-GlobalData ones.
-    class DOMObjectHashTableMap {
-    public:
-        static DOMObjectHashTableMap& mapFor(JSC::JSGlobalData&);
-
-        ~DOMObjectHashTableMap()
-        {
-            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
-            for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
-                iter->second.deleteTable();
-        }
-
-        const JSC::HashTable* get(const JSC::HashTable* staticTable)
-        {
-            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
-            if (iter != m_map.end())
-                return &iter->second;
-            return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
-        }
-
-    private:
-        HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
-    };
-
-    class WebCoreJSClientData : public JSC::JSGlobalData::ClientData {
-        friend class EnterDOMWrapperWorld;
-        friend class JSGlobalDataWorldIterator;
-
-    public:
-        WebCoreJSClientData(JSC::JSGlobalData* globalData)
-            : m_normalWorld(globalData)
-        {
-            m_worldStack.append(&m_normalWorld);
-            m_worldSet.add(&m_normalWorld);
-        }
-        // FIXME: add a destructor to assert m_worldSet only contains m_normalWorld?
-
-        DOMWrapperWorld* currentWorld() { return m_worldStack.last(); }
-        DOMWrapperWorld* normalWorld() { return &m_normalWorld; }
-
-        void rememberWorld(DOMWrapperWorld* world)
-        {
-            ASSERT(!m_worldSet.contains(world));
-            m_worldSet.add(world);
-        }
-        void forgetWorld(DOMWrapperWorld* world)
-        {
-            ASSERT(m_worldSet.contains(world));
-            m_worldSet.remove(world);
-        }
-
-        DOMObjectHashTableMap hashTableMap;
-    private:
-        Vector<DOMWrapperWorld*> m_worldStack;
-        HashSet<DOMWrapperWorld*> m_worldSet;
-        DOMWrapperWorld m_normalWorld;
-    };
-
-    class EnterDOMWrapperWorld {
-    public:
-        EnterDOMWrapperWorld(JSC::JSGlobalData&, DOMWrapperWorld*);
-        EnterDOMWrapperWorld(JSC::ExecState*, DOMWrapperWorld*);
-        ~EnterDOMWrapperWorld();
-
-    private:
-        WebCoreJSClientData* m_clientData;
-    };
-
-    DOMObject* getCachedDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle);
-    void cacheDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle, DOMObject* wrapper);
-    void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document);
+    DOMObject* getCachedDOMObjectWrapper(JSC::ExecState*, void* objectHandle);
+    bool hasCachedDOMObjectWrapper(JSC::JSGlobalData*, void* objectHandle);
+    void cacheDOMObjectWrapper(JSC::ExecState*, void* objectHandle, DOMObject* wrapper);
+    void forgetDOMNode(JSNode* wrapper, Node* node, Document* document);
     void forgetDOMObject(DOMObject* wrapper, void* objectHandle);
 
-    JSNode* getCachedDOMNodeWrapper(Document*, Node*);
-    void cacheDOMNodeWrapper(Document*, Node*, JSNode* wrapper);
+    JSNode* getCachedDOMNodeWrapper(JSC::ExecState*, Document*, Node*);
+    void cacheDOMNodeWrapper(JSC::ExecState*, Document*, Node*, JSNode* wrapper);
     void forgetAllDOMNodesForDocument(Document*);
-    void forgetWorldOfDOMNodesForDocument(Document*, DOMWrapperWorld*);
     void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
+
     void markDOMNodesForDocument(JSC::MarkStack&, Document*);
     void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
+    void markDOMNodeWrapper(JSC::MarkStack& markStack, Document* document, Node* node);
+    bool hasCachedDOMObjectWrapperUnchecked(JSC::JSGlobalData*, void* objectHandle);
+    bool hasCachedDOMNodeWrapperUnchecked(Document*, Node*);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
-    DOMWrapperWorld* currentWorld(JSC::ExecState*);
-    DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
-    DOMWrapperWorld* mainThreadCurrentWorld();
-    DOMWrapperWorld* mainThreadNormalWorld();
-    inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
-    inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
-
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
@@ -283,17 +173,17 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
+        ASSERT(!getCachedDOMObjectWrapper(exec, object));
         // FIXME: new (exec) could use a different globalData than the globalData this wrapper is cached on.
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        cacheDOMObjectWrapper(exec, object, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
             return wrapper;
         return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object);
     }
@@ -302,19 +192,21 @@ namespace WebCore {
     #define CREATE_SVG_OBJECT_WRAPPER(exec, globalObject, className, object, context) createDOMObjectWrapper<JS##className>(exec, globalObject, static_cast<className*>(object), context)
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
-        ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
-        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object, context);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        DOMObject* wrapper = createDOMObjectWrapper<WrapperClass, DOMClass>(exec, globalObject, object);
+        ASSERT(wrapper);
+        if (context)
+            JSSVGContextCache::addWrapper(wrapper, context);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object)) {
+            ASSERT(JSSVGContextCache::svgContextForDOMObject(wrapper) == context);
             return wrapper;
-        return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object, context);
+        }
+        return createDOMObjectWrapper<WrapperClass, DOMClass>(exec, globalObject, object, context);
     }
 #endif
 
@@ -322,18 +214,18 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline JSNode* createDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         ASSERT(node);
-        ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+        ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, node);
         // FIXME: The entire function can be removed, once we fix caching.
         // This function is a one-off hack to make Nodes cache in the right global object.
-        cacheDOMNodeWrapper(node->document(), node, wrapper);
+        cacheDOMNodeWrapper(exec, node->document(), node, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         if (!node)
             return JSC::jsNull();
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node))
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node))
             return wrapper;
         return createDOMNodeWrapper<WrapperClass>(exec, globalObject, node);
     }
@@ -346,6 +238,14 @@ namespace WebCore {
     // Convert a DOM implementation exception code into a JavaScript exception in the execution state.
     void setDOMException(JSC::ExecState*, ExceptionCode);
 
+    JSC::JSValue jsString(JSC::ExecState*, const String&); // empty if the string is null
+    JSC::JSValue jsStringSlowCase(JSC::ExecState*, JSStringCache&, StringImpl*);
+    JSC::JSValue jsString(JSC::ExecState*, const KURL&); // empty if the URL is null
+    inline JSC::JSValue jsString(JSC::ExecState* exec, const AtomicString& s)
+    { 
+        return jsString(exec, s.string());
+    }
+        
     JSC::JSValue jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
     JSC::JSValue jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
 
@@ -362,6 +262,11 @@ namespace WebCore {
     JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null
     JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null or undefined
 
+    // Returns a Date instance for the specified value, or null if the value is NaN or infinity.
+    JSC::JSValue jsDateOrNull(JSC::ExecState*, double);
+    // NaN if the value can't be converted to a date.
+    double valueToDate(JSC::ExecState*, JSC::JSValue);
+
     // FIXME: These are a stop-gap until all toJS calls can be converted to pass a globalObject
     template <typename T>
     inline JSC::JSValue toJS(JSC::ExecState* exec, T* ptr)
@@ -397,17 +302,33 @@ namespace WebCore {
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*, String& message);
     bool shouldAllowNavigation(JSC::ExecState*, Frame*);
     void printErrorMessageForFrame(Frame*, const String& message);
-    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
+    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier& propertyName);
 
     Frame* toLexicalFrame(JSC::ExecState*);
     Frame* toDynamicFrame(JSC::ExecState*);
     bool processingUserGesture(JSC::ExecState*);
     KURL completeURL(JSC::ExecState*, const String& relativeURL);
+    
+    inline JSC::JSValue jsString(JSC::ExecState* exec, const String& s)
+    {
+        StringImpl* stringImpl = s.impl();
+        if (!stringImpl || !stringImpl->length())
+            return jsEmptyString(exec);
 
-    JSC::JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const JSC::UString& script, JSC::JSValue& exception);
-    JSC::JSValue callInWorld(JSC::ExecState*, JSC::JSValue function, JSC::CallType, const JSC::CallData&, JSC::JSValue thisValue, const JSC::ArgList&, DOMWrapperWorld*);
-    JSC::JSObject* constructInWorld(JSC::ExecState* exec, JSC::JSValue object, JSC::ConstructType constructType, const JSC::ConstructData& constructData, const JSC::ArgList& args, DOMWrapperWorld*);
-    JSC::Completion evaluateInWorld(JSC::ExecState*, JSC::ScopeChain&, const JSC::SourceCode&, JSC::JSValue thisValue, DOMWrapperWorld*);
+        if (stringImpl->length() == 1 && stringImpl->characters()[0] <= 0xFF)
+            return jsString(exec, stringImpl->ustring());
+
+        JSStringCache& stringCache = currentWorld(exec)->m_stringCache;
+        if (JSC::JSString* wrapper = stringCache.get(stringImpl))
+            return wrapper;
+
+        return jsStringSlowCase(exec, stringCache, stringImpl);
+    }
+
+    inline DOMObjectWrapperMap& domObjectWrapperMapFor(JSC::ExecState* exec)
+    {
+        return currentWorld(exec)->m_wrappers;
+    }
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMFormDataCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMFormDataCustom.cpp
new file mode 100644
index 0000000..222cbcc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMFormDataCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDOMFormData.h"
+
+#include "DOMFormData.h"
+#include "JSBlob.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSDOMFormData::append(ExecState* exec, const ArgList& args)
+{
+    if (args.size() >= 2) {
+        String name = args.at(0).toString(exec);
+        JSValue value = args.at(1);
+        if (value.inherits(&JSBlob::s_info))
+            impl()->append(name, toBlob(value));
+        else
+            impl()->append(name, value.toString(exec));
+    }
+
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 011a4e4..e0b5b89 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -40,6 +40,8 @@ using namespace JSC;
 
 namespace WebCore {
 
+const ClassInfo JSDOMGlobalObject::s_info = { "DOMGlobalObject", 0, 0, 0 };
+
 JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
     : JSGlobalObject(structure, data, thisValue)
 {
@@ -56,14 +58,9 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
     JSDOMConstructorMap::iterator end2 = constructors().end();
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
         markStack.append(it2->second);
-}
 
-PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
-{
-    if (!val.isObject())
-        return 0;
-
-    return JSEventListener::create(asObject(val), true, currentWorld(globalExec())).get();
+    if (d()->m_injectedScript)
+        markStack.append(d()->m_injectedScript);
 }
 
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
@@ -76,6 +73,16 @@ Event* JSDOMGlobalObject::currentEvent() const
     return d()->evt;
 }
 
+void JSDOMGlobalObject::setInjectedScript(JSObject* injectedScript)
+{
+    d()->m_injectedScript = injectedScript;
+}
+
+JSObject* JSDOMGlobalObject::injectedScript() const
+{
+    return d()->m_injectedScript;
+}
+
 void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData)
 {
     delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index 6b75a6f..8eb55c1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -54,29 +54,29 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Creates a JS EventListener for an "onXXX" event attribute. These
-        // listeners cannot be removed through the removeEventListener API.
-        PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
-
         // Make binding code generation easier.
         JSDOMGlobalObject* globalObject() { return this; }
 
         void setCurrentEvent(Event*);
         Event* currentEvent() const;
 
+        void setInjectedScript(JSObject*);
+        JSObject* injectedScript() const;
+
         virtual void markChildren(JSC::MarkStack&);
 
+        DOMWrapperWorld* world() { return d()->m_world.get(); }
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        static const JSC::ClassInfo s_info;
+
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData()
-                : JSGlobalObjectData(destroyJSDOMGlobalObjectData)
-                , evt(0)
-            {
-            }
-
-            JSDOMGlobalObjectData(Destructor destructor)
+            JSDOMGlobalObjectData(DOMWrapperWorld* world, Destructor destructor = destroyJSDOMGlobalObjectData)
                 : JSGlobalObjectData(destructor)
                 , evt(0)
+                , m_world(world)
+                , m_injectedScript(0)
             {
             }
 
@@ -84,6 +84,8 @@ namespace WebCore {
             JSDOMConstructorMap constructors;
 
             Event* evt;
+            RefPtr<DOMWrapperWorld> m_world;
+            JSObject* m_injectedScript;
         };
 
     private:
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index 86ff149..c25a70a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -24,6 +24,7 @@
 #include "JSDOMWindowBase.h"
 
 #include "CString.h"
+#include "Chrome.h"
 #include "Console.h"
 #include "DOMWindow.h"
 #include "Frame.h"
@@ -35,12 +36,20 @@
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include "WebCoreJSClientData.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
+const ClassInfo JSDOMWindowBase::s_info = { "Window", &JSDOMGlobalObject::s_info, 0, 0 };
+
+JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+    : JSDOMGlobalObjectData(shell->world(), destroyJSDOMWindowBaseData)
+    , impl(window)
+    , shell(shell)
+{
+}
 
 JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
@@ -53,11 +62,10 @@ JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRef
     addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
 }
 
-void JSDOMWindowBase::updateDocument(DOMWrapperWorld* world)
+void JSDOMWindowBase::updateDocument()
 {
     ASSERT(d()->impl->document());
     ExecState* exec = globalExec();
-    EnterDOMWrapperWorld worldEntry(exec, world);
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, this, d()->impl->document()), DontDelete | ReadOnly);
 }
 
@@ -69,7 +77,7 @@ ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
 String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other) const
 {
     KURL originURL = asJSDOMWindow(other)->impl()->url();
-    KURL targetURL = impl()->frame()->document()->url();
+    KURL targetURL = d()->shell->window()->impl()->url();
     if (originURL.isNull() || targetURL.isNull())
         return String();
 
@@ -164,7 +172,7 @@ void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
     delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
 }
 
-// JSDOMGlobalObject* is ignored, accesing a window in any context will
+// JSDOMGlobalObject* is ignored, accessing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
 {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 31e2486..2726996 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -47,7 +47,7 @@ namespace WebCore {
         JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        void updateDocument(DOMWrapperWorld*);
+        void updateDocument();
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -77,12 +77,7 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
-                , impl(window)
-                , shell(shell)
-            {
-            }
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell);
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
@@ -97,7 +92,7 @@ namespace WebCore {
     };
 
     // Returns a JSDOMWindow or jsNull()
-    // JSDOMGlobalObject* is ignored, accesing a window in any context will
+    // JSDOMGlobalObject* is ignored, accessing a window in any context will
     // use that DOMWindow's prototype chain.
     JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMWindow*);
     JSC::JSValue toJS(JSC::ExecState*, DOMWindow*);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2804b3c..e8c2781 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -21,7 +21,8 @@
 #include "JSDOMWindowCustom.h"
 
 #include "AtomicString.h"
-#include "Base64.h"
+#include "Chrome.h"
+#include "Database.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
@@ -35,6 +36,8 @@
 #include "HTMLDocument.h"
 #include "History.h"
 #include "JSAudioConstructor.h"
+#include "JSDatabase.h"
+#include "JSDatabaseCallback.h"
 #include "JSDOMWindowShell.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
@@ -53,14 +56,14 @@
 #endif
 
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArrayConstructor.h"
-#include "JSCanvasUnsignedByteArrayConstructor.h"
-#include "JSCanvasIntArrayConstructor.h"
-#include "JSCanvasUnsignedIntArrayConstructor.h"
-#include "JSCanvasShortArrayConstructor.h"
-#include "JSCanvasUnsignedShortArrayConstructor.h"
-#include "JSCanvasFloatArrayConstructor.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArrayConstructor.h"
+#include "JSWebGLUnsignedByteArrayConstructor.h"
+#include "JSWebGLIntArrayConstructor.h"
+#include "JSWebGLUnsignedIntArrayConstructor.h"
+#include "JSWebGLShortArrayConstructor.h"
+#include "JSWebGLUnsignedShortArrayConstructor.h"
+#include "JSWebGLFloatArrayConstructor.h"
 #endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
@@ -96,7 +99,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
@@ -112,6 +115,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalStatusbar());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalToolbar());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalMedia());
 #if ENABLE(DOM_STORAGE)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalSessionStorage());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocalStorage());
@@ -122,24 +126,24 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 }
 
 template<NativeFunction nativeFunction, int length>
-JSValue nonCachingStaticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+JSValue nonCachingStaticFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), length, propertyName, nativeFunction);
 }
 
-static JSValue childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
 }
 
-static JSValue indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(index)->domWindow());
 }
 
-static JSValue namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSDOMWindowBase* thisObj = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindowBase* thisObj = static_cast<JSDOMWindow*>(asObject(slotBase));
     Document* document = thisObj->impl()->frame()->document();
 
     ASSERT(thisObj->allowsAccessFrom(exec));
@@ -265,7 +269,7 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
         }
     }
 
-    // FIXME: Search the whole frame hierachy somewhere around here.
+    // FIXME: Search the whole frame hierarchy somewhere around here.
     // We need to test the correct priority order.
 
     // allow window[1] or parent[1] etc. (#56983)
@@ -297,10 +301,10 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
 
 bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
-    // are not affected by properties changed on the Window or anything in its prototype chain.
-    // This is consistent with the behavior of Firefox.
-    
+    // Never allow cross-domain getOwnPropertyDescriptor
+    if (!allowsAccessFrom(exec))
+        return false;
+
     const HashEntry* entry;
     
     // We don't want any properties other than "close" and "closed" on a closed window.
@@ -323,65 +327,6 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
         return true;
     }
 
-    String errorMessage;
-    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
-    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
-        return true;
-
-    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
-    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
-    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
-    // what prototype is actually set on this object.
-    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
-                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
-                    descriptor.setUndefined();
-                    return true;
-                }
-            }
-        }
-    } else {
-        // Allow access to toString() cross-domain, but always Object.prototype.toString.
-        if (propertyName == exec->propertyNames().toString) {
-            if (!allowsAccess) {
-                PropertySlot slot;
-                slot.setCustom(this, objectToStringFunctionGetter);
-                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                return true;
-            }
-        }
-    }
-    
     entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
         PropertySlot slot;
@@ -402,19 +347,6 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
         return true;
     }
     
-    // Do prototype lookup early so that functions and attributes in the prototype can have
-    // precedence over the index and name getters.  
-    JSValue proto = prototype();
-    if (proto.isObject()) {
-        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
-            if (!allowsAccess) {
-                printErrorMessage(errorMessage);
-                descriptor.setUndefined();
-            }
-            return true;
-        }
-    }
-
     bool ok;
     unsigned i = propertyName.toArrayIndex(&ok);
     if (ok && i < impl()->frame()->tree()->childCount()) {
@@ -466,28 +398,20 @@ bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getPropertyNames(exec, propertyNames, mode);
 }
 
-void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    // Only allow getting property attributes properties by frames in the same origin.
-    if (!allowsAccessFrom(exec))
-        return false;
-    return Base::getPropertyAttributes(exec, propertyName, attributes);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
@@ -540,24 +464,24 @@ JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyNam
 JSValue JSDOMWindow::history(ExecState* exec) const
 {
     History* history = impl()->history();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, history))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, window), window, history);
-    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    cacheDOMObjectWrapper(exec, history, jsHistory);
     return jsHistory;
 }
 
 JSValue JSDOMWindow::location(ExecState* exec) const
 {
     Location* location = impl()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), window, location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -645,44 +569,44 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
 }
  
 #if ENABLE(3D_CANVAS)
-JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+JSValue JSDOMWindow::webGLArrayBuffer(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLArrayBufferConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLFloatArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLFloatArrayConstructor>(exec, this);
 }
 #endif
  
@@ -744,6 +668,12 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     ASSERT(lexicalFrame);
     ASSERT(dynamicFrame);
 
+    if (Document* lexicalDocument = lexicalFrame->document()) {
+        // Sandboxed iframes cannot open new auxiliary browsing contexts.
+        if (lexicalDocument->securityOrigin()->isSandboxed(SandboxNavigation))
+            return 0;
+    }
+
     ResourceRequest request;
 
     // For whatever reason, Firefox uses the dynamicGlobalObject to determine
@@ -790,6 +720,14 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     return newFrame;
 }
 
+static bool domWindowAllowPopUp(Frame* activeFrame, ExecState* exec)
+{
+    ASSERT(activeFrame);
+    if (activeFrame->script()->processingUserGesture(currentWorld(exec)))
+        return true;
+    return DOMWindow::allowPopUp(activeFrame);
+}
+
 JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
     String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
@@ -810,7 +748,7 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
     // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
     // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
-    if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
+    if (!domWindowAllowPopUp(dynamicFrame, exec) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
         return jsUndefined();
 
     // Get the target frame for the special cases of _top and _parent.  In those
@@ -880,7 +818,7 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     if (!dynamicFrame)
         return jsUndefined();
 
-    if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
+    if (!DOMWindow::canShowModalDialogNow(frame) || !domWindowAllowPopUp(dynamicFrame, exec))
         return jsUndefined();
 
     HashMap<String, String> features;
@@ -976,71 +914,30 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setTimeout(action, delay));
+
+    ExceptionCode ec = 0;
+    int result = impl()->setTimeout(action.release(), delay, ec);
+    setDOMException(exec, ec);
+
+    return jsNumber(exec, result);
 }
 
 JSValue JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setInterval(action, delay));
-}
 
-JSValue JSDOMWindow::atob(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return throwError(exec, SyntaxError, "Not enough arguments");
-
-    JSValue v = args.at(0);
-    if (v.isNull())
-        return jsEmptyString(exec);
-
-    UString s = v.toString(exec);
-    if (!s.is8Bit()) {
-        setDOMException(exec, INVALID_CHARACTER_ERR);
-        return jsUndefined();
-    }
-
-    Vector<char> in(s.size());
-    for (int i = 0; i < s.size(); ++i)
-        in[i] = static_cast<char>(s.data()[i]);
-    Vector<char> out;
-
-    if (!base64Decode(in, out))
-        return throwError(exec, GeneralError, "Cannot decode base64");
-
-    return jsString(exec, String(out.data(), out.size()));
-}
-
-JSValue JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return throwError(exec, SyntaxError, "Not enough arguments");
-
-    JSValue v = args.at(0);
-    if (v.isNull())
-        return jsEmptyString(exec);
-
-    UString s = v.toString(exec);
-    if (!s.is8Bit()) {
-        setDOMException(exec, INVALID_CHARACTER_ERR);
-        return jsUndefined();
-    }
-
-    Vector<char> in(s.size());
-    for (int i = 0; i < s.size(); ++i)
-        in[i] = static_cast<char>(s.data()[i]);
-    Vector<char> out;
-
-    base64Encode(in, out);
+    ExceptionCode ec = 0;
+    int result = impl()->setInterval(action.release(), delay, ec);
+    setDOMException(exec, ec);
 
-    return jsString(exec, String(out.data(), out.size()));
+    return jsNumber(exec, result);
 }
 
 JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
@@ -1053,7 +950,7 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -1067,10 +964,30 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+#if ENABLE(DATABASE)
+JSValue JSDOMWindow::openDatabase(ExecState* exec, const ArgList& args)
+{
+    if (!allowsAccessFrom(exec) || (args.size() < 4))
+        return jsUndefined();
+    ExceptionCode ec = 0;
+    const UString& name = args.at(0).toString(exec);
+    const UString& version = args.at(1).toString(exec);
+    const UString& displayName = args.at(2).toString(exec);
+    unsigned long estimatedSize = args.at(3).toInt32(exec);
+    RefPtr<DatabaseCallback> creationCallback;
+    if ((args.size() >= 5) && args.at(4).isObject())
+        creationCallback = JSDatabaseCallback::create(asObject(args.at(4)), globalObject());
+
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(impl()->openDatabase(name, version, displayName, estimatedSize, creationCallback.release(), ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+#endif
+
 DOMWindow* toDOMWindow(JSValue value)
 {
     if (!value.isObject())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index 9072f91..1e82a49 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -43,9 +43,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
 
-JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window)
+JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window, DOMWrapperWorld* world)
     : Base(JSDOMWindowShell::createStructure(jsNull()))
     , m_window(0)
+    , m_world(world)
 {
     setWindow(window);
 }
@@ -113,19 +114,14 @@ bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propert
     return m_window->deleteProperty(exec, propertyName);
 }
 
-void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_window->getPropertyNames(exec, propertyNames);
+    m_window->getPropertyNames(exec, propertyNames, mode);
 }
 
-void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_window->getOwnPropertyNames(exec, propertyNames);
-}
-
-bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    return m_window->getPropertyAttributes(exec, propertyName, attributes);
+    m_window->getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 36cb8d6..1b986b8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -40,7 +40,7 @@ namespace WebCore {
     class JSDOMWindowShell : public DOMObject {
         typedef DOMObject Base;
     public:
-        JSDOMWindowShell(PassRefPtr<DOMWindow>);
+        JSDOMWindowShell(PassRefPtr<DOMWindow>, DOMWrapperWorld* world);
         virtual ~JSDOMWindowShell();
 
         JSDOMWindow* window() const { return m_window; }
@@ -60,9 +60,11 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
+        DOMWrapperWorld* world() { return m_world.get(); }
+
     private:
         static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | DOMObject::StructureFlags;
 
@@ -73,9 +75,8 @@ namespace WebCore {
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
+        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
         virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
@@ -85,6 +86,7 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
         JSDOMWindow* m_window;
+        RefPtr<DOMWrapperWorld> m_world;
     };
 
     JSC::JSValue toJS(JSC::ExecState*, Frame*);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.cpp
new file mode 100644
index 0000000..3fcdcc1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDOMWrapper.h"
+
+#include "JSDebugWrapperSet.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+#ifndef NDEBUG
+
+DOMObject::~DOMObject()
+{
+    ASSERT(!JSDebugWrapperSet::shared().contains(this));
+}
+
+#endif
+
+bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
+{
+    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
+    return false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.h
new file mode 100644
index 0000000..00594cf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.h
@@ -0,0 +1,46 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSDOMWrapper_h
+#define JSDOMWrapper_h
+
+#include <runtime/JSObject.h>
+
+namespace WebCore {
+
+// Base class for all objects in this binding except Window.
+class DOMObject : public JSC::JSObject {
+protected:
+    explicit DOMObject(NonNullPassRefPtr<JSC::Structure> structure) 
+        : JSObject(structure)
+    {
+    }
+
+    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
+
+#ifndef NDEBUG
+    virtual ~DOMObject();
+#endif
+};
+
+} // namespace WebCore
+
+#endif // JSDOMWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
index 91b3d15..9a6982a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
@@ -43,9 +43,9 @@ bool JSDataGridColumnList::canGetItemsForName(ExecState*, DataGridColumnList* im
     return impl->itemWithName(propertyName);
 }
 
-JSValue JSDataGridColumnList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSDataGridColumnList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     return toJS(exec, thisObj->globalObject(), thisObj->impl()->itemWithName(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.cpp
new file mode 100644
index 0000000..c75a6e5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDatabaseCallback.h"
+
+#if ENABLE(DATABASE)
+
+#include "Frame.h"
+#include "JSDatabase.h"
+#include "ScriptController.h"
+#include "ScriptExecutionContext.h"
+#include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+JSDatabaseCallback::JSDatabaseCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
+    , m_isolatedWorld(DOMWrapperWorld::create(globalObject->globalData(), true))
+{
+}
+
+JSDatabaseCallback::~JSDatabaseCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
+
+void JSDatabaseCallback::handleEvent(ScriptExecutionContext* context, Database* database)
+{
+    ASSERT(m_data);
+    ASSERT(context);
+
+    RefPtr<JSDatabaseCallback> protect(this);
+
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context, m_isolatedWorld.get());
+    if (!globalObject)
+        return;
+
+    ExecState* exec = globalObject->globalExec();
+    MarkedArgumentBuffer args;
+    args.append(toJS(exec, database));
+
+    bool ignored;
+    m_data->invokeCallback(args, &ignored);
+}
+
+}
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.h
index df52379..2f9234e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,31 +28,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptObjectQuarantine_h
-#define ScriptObjectQuarantine_h
+#ifndef JSDatabaseCallback_h
+#define JSDatabaseCallback_h
 
-#include "ScriptState.h"
+#if ENABLE(DATABASE)
+
+#include "DatabaseCallback.h"
+#include "JSCallbackData.h"
 
 namespace WebCore {
 
-    class Database;
-    class DOMWindow;
-    class Node;
-    class ScriptObject;
-    class ScriptValue;
-    class Storage;
+class ScriptExecutionContext;
 
-    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+class JSDatabaseCallback : public DatabaseCallback {
+public:
+    static PassRefPtr<JSDatabaseCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSDatabaseCallback(callback, globalObject));
+    }
 
-#if ENABLE(DATABASE)
-    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
-#endif
-#if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
-#endif
-    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+    virtual ~JSDatabaseCallback();
+
+    virtual void handleEvent(ScriptExecutionContext*, Database*);
+
+private:
+    JSDatabaseCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
+
+    JSCallbackData* m_data;
+    RefPtr<DOMWrapperWorld> m_isolatedWorld;
+};
 
 }
 
-#endif // ScriptObjectQuarantine_h
+#endif // ENABLE(DATABASE)
+
+#endif // JSDatabaseCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.cpp
new file mode 100644
index 0000000..b0d6ca9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDebugWrapperSet.h"
+
+#include <wtf/StdLibExtras.h>
+
+#if ENABLE(WORKERS)
+#include <wtf/ThreadSpecific.h>
+#endif
+
+namespace WebCore {
+
+JSDebugWrapperSet& JSDebugWrapperSet::shared()
+{
+#if ENABLE(WORKERS)
+    DEFINE_STATIC_LOCAL(WTF::ThreadSpecific<JSDebugWrapperSet>, staticWrapperSet, ());
+    return *staticWrapperSet;
+#else
+    DEFINE_STATIC_LOCAL(JSDebugWrapperSet, staticWrapperSet, ());
+    return staticWrapperSet;
+#endif
+}
+
+JSDebugWrapperSet::JSDebugWrapperSet()
+{
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.h
new file mode 100644
index 0000000..94b6f78
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSDebugWrapperSet_h
+#define JSDebugWrapperSet_h
+
+#include "JSDOMWrapper.h"
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+// For debugging, keep a set of wrappers currently cached, and check that
+// all are uncached before they are destroyed. This helps us catch bugs like:
+//     - wrappers being deleted without being removed from the cache
+//     - wrappers being cached twice
+
+class JSDebugWrapperSet : public Noncopyable {
+    friend class WTF::ThreadSpecific<JSDebugWrapperSet>;
+public:
+    static JSDebugWrapperSet& shared();
+
+    void add(DOMObject* object) { m_wrapperSet.add(object); }
+    void remove(DOMObject* object) { m_wrapperSet.remove(object); }
+    bool contains(DOMObject* object) const { return m_wrapperSet.contains(object); }
+
+    static void willCacheWrapper(DOMObject*);
+    static void didUncacheWrapper(DOMObject*);
+
+private:
+    JSDebugWrapperSet();
+
+    HashSet<DOMObject*> m_wrapperSet;
+};
+
+#ifdef NDEBUG
+
+inline void JSDebugWrapperSet::willCacheWrapper(DOMObject*)
+{
+}
+
+inline void JSDebugWrapperSet::didUncacheWrapper(DOMObject*)
+{
+}
+
+#else
+
+inline void JSDebugWrapperSet::willCacheWrapper(DOMObject* wrapper)
+{
+    ASSERT(!JSDebugWrapperSet::shared().contains(wrapper));
+    JSDebugWrapperSet::shared().add(wrapper);
+}
+
+inline void JSDebugWrapperSet::didUncacheWrapper(DOMObject* wrapper)
+{
+    if (!wrapper)
+        return;
+    ASSERT(JSDebugWrapperSet::shared().contains(wrapper));
+    JSDebugWrapperSet::shared().remove(wrapper);
+}
+
+#endif
+
+} // namespace WebCore
+
+#endif // JSDebugWrapperSet_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index d7f8725..eda153e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -26,7 +26,7 @@
 #include "HTMLDocument.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
@@ -65,11 +65,11 @@ JSValue JSDocument::location(ExecState* exec) const
         return jsNull();
 
     Location* location = frame->domWindow()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, globalObject()), globalObject(), location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -87,7 +87,7 @@ void JSDocument::setLocation(ExecState* exec, JSValue value)
     if (activeFrame)
         str = activeFrame->document()->completeURL(str).string();
 
-    bool userGesture = activeFrame->script()->processingUserGesture();
+    bool userGesture = activeFrame->script()->processingUserGesture(currentWorld(exec));
     frame->redirectScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
@@ -96,18 +96,18 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* documen
     if (!document)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), document);
+    DOMObject* wrapper = getCachedDOMNodeWrapper(exec, document, document);
     if (wrapper)
         return wrapper;
 
     if (document->isHTMLDocument())
-        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, HTMLDocument, document);
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, globalObject, HTMLDocument, document);
 #if ENABLE(SVG)
     else if (document->isSVGDocument())
-        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, SVGDocument, document);
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGDocument, document);
 #endif
     else
-        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, Document, document);
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, globalObject, Document, document);
 
     // Make sure the document is kept around by the window object, and works right with the
     // back/forward cache.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
index fb64ff2..c725290 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
@@ -145,7 +145,7 @@ JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Eleme
     if (!element)
         return jsNull();
 
-    ASSERT(!getCachedDOMNodeWrapper(element->document(), element));
+    ASSERT(!getCachedDOMNodeWrapper(exec, element->document(), element));
 
     JSNode* wrapper;        
     if (element->isHTMLElement())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index edf9151..6686d7a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -30,9 +30,13 @@
 #include "JSEvent.h"
 
 #include "Clipboard.h"
+#include "CompositionEvent.h"
+#include "CustomEvent.h"
 #include "Event.h"
 #include "JSBeforeLoadEvent.h"
 #include "JSClipboard.h"
+#include "JSCustomEvent.h"
+#include "JSCompositionEvent.h"
 #include "JSErrorEvent.h"
 #include "JSKeyboardEvent.h"
 #include "JSMessageEvent.h"
@@ -40,6 +44,7 @@
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
 #include "JSPageTransitionEvent.h"
+#include "JSPopStateEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -55,6 +60,7 @@
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
 #include "PageTransitionEvent.h"
+#include "PopStateEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -74,6 +80,11 @@
 #include "SVGZoomEvent.h"
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+#include "JSTouchEvent.h"
+#include "TouchEvent.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -90,7 +101,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     if (!event)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), event);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, event);
     if (wrapper)
         return wrapper;
 
@@ -107,6 +118,12 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         else if (event->isSVGZoomEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, SVGZoomEvent, event);
 #endif
+        else if (event->isCompositionEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, CompositionEvent, event);
+#if ENABLE(TOUCH_EVENTS)
+        else if (event->isTouchEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, TouchEvent, event);
+#endif
         else
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, UIEvent, event);
     } else if (event->isMutationEvent())
@@ -136,6 +153,10 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     else if (event->isErrorEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ErrorEvent, event);
 #endif
+    else if (event->isPopStateEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PopStateEvent, event);
+    else if (event->isCustomEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, CustomEvent, event);
     else
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, Event, event);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index 1a999a8..be049db 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -31,9 +31,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSEventListener::JSEventListener(JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld)
+JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld)
     : EventListener(JSEventListenerType)
     , m_jsFunction(function)
+    , m_wrapper(wrapper)
     , m_isAttribute(isAttribute)
     , m_isolatedWorld(isolatedWorld)
 {
@@ -43,9 +44,10 @@ JSEventListener::~JSEventListener()
 {
 }
 
-JSObject* JSEventListener::jsFunction(ScriptExecutionContext*) const
+JSObject* JSEventListener::initializeJSFunction(ScriptExecutionContext*) const
 {
-    return m_jsFunction;
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
 void JSEventListener::markJSFunction(MarkStack& markStack)
@@ -81,18 +83,13 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
             return;
         // FIXME: Is this check needed for other contexts?
         ScriptController* script = frame->script();
-        if (!script->isEnabled() || script->isPaused())
+        if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
             return;
     }
 
     ExecState* exec = globalObject->globalExec();
+    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
 
-    JSValue handleEventFunction;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
-    }
     CallData callData;
     CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -114,8 +111,8 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
         globalData->timeoutChecker.start();
         JSValue retval = handleEventFunction
-            ? callInWorld(exec, handleEventFunction, callType, callData, jsFunction, args, m_isolatedWorld.get())
-            : callInWorld(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args, m_isolatedWorld.get());
+            ? JSC::call(exec, handleEventFunction, callType, callData, jsFunction, args)
+            : JSC::call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
         globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
@@ -132,8 +129,6 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
             }
         }
 
-        if (scriptExecutionContext->isDocument())
-            Document::updateStyleForAllDocuments();
         deref();
     }
 }
@@ -166,7 +161,7 @@ bool JSEventListener::reportError(ScriptExecutionContext* context, const String&
     JSValue thisValue = globalObject->toThisObject(exec);
 
     globalData->timeoutChecker.start();
-    JSValue returnValue = callInWorld(exec, jsFunction, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSValue returnValue = JSC::call(exec, jsFunction, callType, callData, thisValue, args);
     globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index bf3af48..569c192 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -22,7 +22,7 @@
 
 #include "EventListener.h"
 #include "JSDOMWindow.h"
-#include <runtime/Protect.h>
+#include <runtime/WeakGCPtr.h>
 
 namespace WebCore {
 
@@ -30,9 +30,9 @@ namespace WebCore {
 
     class JSEventListener : public EventListener {
     public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute, DOMWrapperWorld* isolatedWorld)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSC::JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSEventListener(listener, isAttribute, isolatedWorld));
+            return adoptRef(new JSEventListener(listener, wrapper, isAttribute, isolatedWorld));
         }
 
         static const JSEventListener* cast(const EventListener* listener)
@@ -49,23 +49,64 @@ namespace WebCore {
         // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
         bool isAttribute() const { return m_isAttribute; }
 
-        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
+        JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
+        DOMWrapperWorld* isolatedWorld() const { return m_isolatedWorld.get(); }
+
+        JSC::JSObject* wrapper() const { return m_wrapper.get(); }
+        void setWrapper(JSC::JSObject* wrapper) const { m_wrapper = wrapper; }
 
     private:
+        virtual JSC::JSObject* initializeJSFunction(ScriptExecutionContext*) const;
         virtual void markJSFunction(JSC::MarkStack&);
+        virtual void invalidateJSFunction(JSC::JSObject*);
         virtual void handleEvent(ScriptExecutionContext*, Event*);
         virtual bool reportError(ScriptExecutionContext*, const String& message, const String& url, int lineNumber);
         virtual bool virtualisAttribute() const;
-        void clearJSFunctionInline();
 
     protected:
-        JSEventListener(JSC::JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld);
+        JSEventListener(JSC::JSObject* function, JSC::JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld);
 
+    private:
         mutable JSC::JSObject* m_jsFunction;
+        mutable JSC::WeakGCPtr<JSC::JSObject> m_wrapper;
+
         bool m_isAttribute;
         RefPtr<DOMWrapperWorld> m_isolatedWorld;
     };
 
+    inline JSC::JSObject* JSEventListener::jsFunction(ScriptExecutionContext* scriptExecutionContext) const
+    {
+        if (!m_jsFunction)
+            m_jsFunction = initializeJSFunction(scriptExecutionContext);
+
+        // Verify that we have a valid wrapper protecting our function from
+        // garbage collection.
+        ASSERT(m_wrapper || !m_jsFunction);
+        if (!m_wrapper)
+            return 0;
+
+        // Try to verify that m_jsFunction wasn't recycled. (Not exact, since an
+        // event listener can be almost anything, but this makes test-writing easier).
+        ASSERT(!m_jsFunction || static_cast<JSC::JSCell*>(m_jsFunction)->isObject());
+
+        return m_jsFunction;
+    }
+
+    inline void JSEventListener::invalidateJSFunction(JSC::JSObject* wrapper)
+    {
+        m_wrapper.clear(wrapper);
+    }
+
+    // Creates a JS EventListener for an "onXXX" event attribute.
+    inline PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::ExecState* exec, JSC::JSValue listener, JSC::JSObject* wrapper)
+    {
+        if (!listener.isObject())
+            return 0;
+
+        return JSEventListener::create(asObject(listener), wrapper, true, currentWorld(exec));
+    }
+
+
 } // namespace WebCore
 
 #endif // JSEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
index 8f0dfb1..dab3285 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -49,7 +49,7 @@ JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -59,7 +59,7 @@ JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
index 530b89b..8bc348c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSGeolocation.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "DOMWindow.h"
 #include "ExceptionCode.h"
 #include "Geolocation.h"
@@ -178,3 +180,5 @@ JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
index fd1dd11..06b3ce4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
@@ -112,9 +112,9 @@ bool JSHTMLAllCollection::canGetItemsForName(ExecState*, HTMLAllCollection* coll
     return !namedItems.isEmpty();
 }
 
-JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slotBase));
     return getNamedItems(exec, thisObj, propertyName);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index 30892e0..40d20cf 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -53,14 +53,4 @@ CallType JSHTMLAppletElement::getCallData(CallData& callData)
     return runtimeObjectGetCallData(impl(), callData);
 }
 
-bool JSHTMLAppletElement::canGetItemsForName(ExecState*, HTMLAppletElement*, const Identifier& propertyName)
-{
-    return propertyName == "__apple_runtime_object";
-}
-
-JSValue JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return runtimeObjectGetter(exec, propertyName, slot);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
index 8ecd287..80634f7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -26,10 +26,12 @@
 #include "config.h"
 #include "JSHTMLCanvasElement.h"
 
+#include "CanvasContextAttributes.h"
 #include "HTMLCanvasElement.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
+#include "WebGLContextAttributes.h"
 #endif
 #include <wtf/GetPtr.h>
 
@@ -47,4 +49,36 @@ void JSHTMLCanvasElement::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, canvas->renderingContext());
 }
 
+JSValue JSHTMLCanvasElement::getContext(ExecState* exec, const ArgList& args)
+{
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(impl());
+    const UString& contextId = args.at(0).toString(exec);
+    RefPtr<CanvasContextAttributes> attrs;
+#if ENABLE(3D_CANVAS)
+    if (contextId == "experimental-webgl" || contextId == "webkit-3d") {
+        attrs = WebGLContextAttributes::create();
+        WebGLContextAttributes* webGLAttrs = static_cast<WebGLContextAttributes*>(attrs.get());
+        if (args.size() > 1 && args.at(1).isObject()) {
+            JSObject* jsAttrs = args.at(1).getObject();
+            Identifier alpha(exec, "alpha");
+            if (jsAttrs->hasProperty(exec, alpha))
+                webGLAttrs->setAlpha(jsAttrs->get(exec, alpha).toBoolean(exec));
+            Identifier depth(exec, "depth");
+            if (jsAttrs->hasProperty(exec, depth))
+                webGLAttrs->setDepth(jsAttrs->get(exec, depth).toBoolean(exec));
+            Identifier stencil(exec, "stencil");
+            if (jsAttrs->hasProperty(exec, stencil))
+                webGLAttrs->setStencil(jsAttrs->get(exec, stencil).toBoolean(exec));
+            Identifier antialias(exec, "antialias");
+            if (jsAttrs->hasProperty(exec, antialias))
+                webGLAttrs->setAntialias(jsAttrs->get(exec, antialias).toBoolean(exec));
+            Identifier premultipliedAlpha(exec, "premultipliedAlpha");
+            if (jsAttrs->hasProperty(exec, premultipliedAlpha))
+                webGLAttrs->setPremultipliedAlpha(jsAttrs->get(exec, premultipliedAlpha).toBoolean(exec));
+        }
+    }
+#endif
+    return toJS(exec, globalObject(), WTF::getPtr(canvas->getContext(contextId, attrs.get())));
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index dd4ceaa..73728ed 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -109,9 +109,9 @@ bool JSHTMLCollection::canGetItemsForName(ExecState*, HTMLCollection* collection
     return !namedItems.isEmpty();
 }
 
-JSValue JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLCollection::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
+    JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slotBase));
     return getNamedItems(exec, thisObj, propertyName);
 }
 
@@ -134,7 +134,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, HTMLCollection* c
     if (!collection)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), collection);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, collection);
 
     if (wrapper)
         return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index a65ca7c..410c553 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -55,9 +55,9 @@ bool JSHTMLDocument::canGetItemsForName(ExecState*, HTMLDocument* document, cons
     return atomicPropertyName && (document->hasNamedItem(atomicPropertyName) || document->hasExtraNamedItem(atomicPropertyName));
 }
 
-JSValue JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slotBase));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
 
     String name = propertyName;
@@ -113,7 +113,7 @@ JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
                 CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
-                return callInWorld(exec, function, callType, callData, wrapper, args, currentWorld(exec));
+                return JSC::call(exec, function, callType, callData, wrapper, args);
             }
         }
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index bce3ffb..b9f8c12 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -53,14 +53,4 @@ CallType JSHTMLEmbedElement::getCallData(CallData& callData)
     return runtimeObjectGetCallData(impl(), callData);
 }
 
-bool JSHTMLEmbedElement::canGetItemsForName(ExecState*, HTMLEmbedElement*, const Identifier& propertyName)
-{
-    return propertyName == "__apple_runtime_object";
-}
-
-JSValue JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return runtimeObjectGetter(exec, propertyName, slot);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index de9ec4a..36ddfb1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -44,9 +44,9 @@ bool JSHTMLFormElement::canGetItemsForName(ExecState*, HTMLFormElement* form, co
     return namedItems.size();
 }
 
-JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFormElement::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     HTMLFormElement* form = static_cast<HTMLFormElement*>(jsForm->impl());
 
     Vector<RefPtr<Node> > namedItems;
@@ -66,7 +66,7 @@ JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
     Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!activeFrame)
         return jsUndefined();
-    static_cast<HTMLFormElement*>(impl())->submit(0, false, !activeFrame->script()->anyPageIsProcessingUserGesture());
+    static_cast<HTMLFormElement*>(impl())->submit(activeFrame);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index 68769d6..484c357 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -47,9 +47,9 @@ bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement*
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slotBase));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
 
     Node* frame = element->children()->namedItem(propertyName);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index 1bfb51f..68c9e59 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -53,14 +53,4 @@ CallType JSHTMLObjectElement::getCallData(CallData& callData)
     return runtimeObjectGetCallData(impl(), callData);
 }
 
-bool JSHTMLObjectElement::canGetItemsForName(ExecState*, HTMLObjectElement*, const Identifier& propertyName)
-{
-    return propertyName == "__apple_runtime_object";
-}
-
-JSValue JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return runtimeObjectGetter(exec, propertyName, slot);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
index b24b1ff..c031b30 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -38,17 +38,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionBack);
 }
 
-static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionForward);
 }
 
-static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsHistoryPrototypeFunctionGo);
 }
@@ -95,15 +95,15 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
 
 bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing History cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, impl()->frame(), message))
-        return false;
-    
+    if (!impl()->frame()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    // Throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return true;
+
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
@@ -133,8 +133,7 @@ bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifi
             return true;
         }
     }
-    
-    printErrorMessageForFrame(impl()->frame(), message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -155,12 +154,60 @@ bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSHistory::pushState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
+JSValue JSHistory::replaceState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
index 0f4a991..a574326 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -24,7 +24,6 @@
 #include "HTMLNames.h"
 #include "JSHTMLImageElement.h"
 #include "JSNode.h"
-#include "ScriptExecutionContext.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -43,35 +42,30 @@ JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globa
 
 static JSObject* constructImage(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    bool widthSet = false;
-    bool heightSet = false;
-    int width = 0;
-    int height = 0;
-    if (args.size() > 0) {
-        widthSet = true;
-        width = args.at(0).toInt32(exec);
-    }
-    if (args.size() > 1) {
-        heightSet = true;
-        height = args.at(1).toInt32(exec);
-    }
-
     JSImageConstructor* jsConstructor = static_cast<JSImageConstructor*>(constructor);
     Document* document = jsConstructor->document();
     if (!document)
         return throwError(exec, ReferenceError, "Image constructor associated document is unavailable");
 
     // Calling toJS on the document causes the JS document wrapper to be
-    // added to the window object. This is done to ensure that JSDocument::mark
-    // will be called (which will cause the image element to be marked if necessary).
+    // added to the window object. This is done to ensure that JSDocument::markChildren
+    // will be called, which will cause the image element to be marked if necessary.
     toJS(exec, jsConstructor->globalObject(), document);
+    int width;
+    int height;
+    int* optionalWidth = 0;
+    int* optionalHeight = 0;
+    if (args.size() > 0) {
+        width = args.at(0).toInt32(exec);
+        optionalWidth = &width;
+    }
+    if (args.size() > 1) {
+        height = args.at(1).toInt32(exec);
+        optionalHeight = &height;
+    }
 
-    RefPtr<HTMLImageElement> image = new HTMLImageElement(HTMLNames::imgTag, document);
-    if (widthSet)
-        image->setWidth(width);
-    if (heightSet)
-        image->setHeight(height);
-    return asObject(toJS(exec, jsConstructor->globalObject(), image.release()));
+    return asObject(toJS(exec, jsConstructor->globalObject(),
+        HTMLImageElement::createForJSConstructor(document, optionalWidth, optionalHeight)));
 }
 
 ConstructType JSImageConstructor::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
index fa3b1d5..61c5112 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -41,7 +41,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     if (!imageData)
         return jsNull();
     
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), imageData);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, imageData);
     if (wrapper)
         return wrapper;
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
new file mode 100644
index 0000000..75597fb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -0,0 +1,234 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInjectedScriptHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Console.h"
+#if ENABLE(DATABASE)
+#include "Database.h"
+#include "JSDatabase.h"
+#endif
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
+#include "InspectorController.h"
+#include "InspectorResource.h"
+#include "JSDOMWindow.h"
+#include "JSNode.h"
+#include "JSRange.h"
+#include "Node.h"
+#include "Page.h"
+#if ENABLE(DOM_STORAGE)
+#include "SerializedScriptValue.h"
+#include "Storage.h"
+#include "JSStorage.h"
+#endif
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+#include <parser/SourceCode.h>
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JavaScriptCallFrame.h"
+#include "JSJavaScriptCallFrame.h"
+#include "ScriptDebugServer.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptObject InjectedScriptHost::createInjectedScript(const String& source, ScriptState* scriptState, long id)
+{
+    SourceCode sourceCode = makeSource(source);
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSValue globalThisValue = scriptState->globalThisValue();
+    Completion comp = JSC::evaluate(scriptState, globalObject->globalScopeChain(), sourceCode, globalThisValue);
+    if (comp.complType() != JSC::Normal && comp.complType() != JSC::ReturnValue)
+        return ScriptObject();
+    JSValue functionValue = comp.value();
+    CallData callData;
+    CallType callType = functionValue.getCallData(callData);
+    if (callType == CallTypeNone)
+        return ScriptObject();
+
+    MarkedArgumentBuffer args;
+    args.append(toJS(scriptState, globalObject, this));
+    args.append(globalThisValue);
+    args.append(jsNumber(scriptState, id));
+    JSValue result = JSC::call(scriptState, functionValue, callType, callData, globalThisValue, args);
+    if (result.isObject())
+        return ScriptObject(scriptState, result.getObject());
+    return ScriptObject();
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInjectedScriptHost::databaseForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
+    if (!database)
+        return jsUndefined();
+    return toJS(exec, database);
+}
+#endif
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+JSValue JSInjectedScriptHost::currentCallFrame(ExecState* exec, const ArgList&)
+{
+    JavaScriptCallFrame* callFrame = ScriptDebugServer::shared().currentCallFrame();
+    if (!callFrame || !callFrame->isValid())
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    return toJS(exec, callFrame);
+}
+
+JSValue JSInjectedScriptHost::isActivation(ExecState*, const ArgList& args)
+{
+    JSObject* object = args.at(0).getObject();
+    return jsBoolean(object && object->isActivationObject());
+}
+#endif
+
+JSValue JSInjectedScriptHost::nodeForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
+    if (!node)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    return toJS(exec, node);
+}
+
+JSValue JSInjectedScriptHost::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 3)
+        return jsUndefined();
+
+    Node* node = toNode(args.at(0));
+    if (!node)
+        return jsUndefined();
+
+    bool withChildren = args.at(1).toBoolean(exec);
+    bool selectInUI = args.at(2).toBoolean(exec);
+    return jsNumber(exec, impl()->pushNodePathToFrontend(node, withChildren, selectInUI));
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInjectedScriptHost::selectDatabase(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Database* database = toDatabase(args.at(0));
+    if (database)
+        impl()->selectDatabase(database);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+JSValue JSInjectedScriptHost::selectDOMStorage(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    Storage* storage = toStorage(args.at(0));
+    if (storage)
+        impl()->selectDOMStorage(storage);
+    return jsUndefined();
+}
+#endif
+
+JSValue JSInjectedScriptHost::reportDidDispatchOnInjectedScript(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 3)
+        return jsUndefined();
+    
+    if (!args.at(0).isInt32())
+        return jsUndefined();
+    int callId = args.at(0).asInt32();
+    
+    RefPtr<SerializedScriptValue> result(SerializedScriptValue::create(exec, args.at(1)));
+    
+    bool isException;
+    if (!args.at(2).getBoolean(isException))
+        return jsUndefined();
+    impl()->reportDidDispatchOnInjectedScript(callId, result.get(), isException);
+    return jsUndefined();
+}
+
+InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState* scriptState)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSObject* injectedScript = globalObject->injectedScript();
+    if (injectedScript)
+        return InjectedScript(ScriptObject(scriptState, injectedScript));
+
+    ASSERT(!m_injectedScriptSource.isEmpty()); 
+    pair<long, ScriptObject> injectedScriptObject = injectScript(m_injectedScriptSource, scriptState);
+    globalObject->setInjectedScript(injectedScriptObject.second.jsObject());
+    InjectedScript result(injectedScriptObject.second);
+    m_idToInjectedScript.set(injectedScriptObject.first, result);
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
deleted file mode 100644
index ed79427..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSInspectedObjectWrapper.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "JSInspectorCallbackWrapper.h"
-#include <runtime/JSGlobalObject.h>
-#include <wtf/StdLibExtras.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper);
-
-typedef HashMap<JSObject*, JSInspectedObjectWrapper*> WrapperMap;
-typedef HashMap<JSGlobalObject*, WrapperMap*> GlobalObjectWrapperMap;
-
-static GlobalObjectWrapperMap& wrappers()
-{
-    DEFINE_STATIC_LOCAL(GlobalObjectWrapperMap, map, ());
-    return map;
-}
-
-const ClassInfo JSInspectedObjectWrapper::s_info = { "JSInspectedObjectWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
-
-JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
-{
-    if (!unwrappedValue.isObject())
-        return unwrappedValue;
-
-    JSObject* unwrappedObject = asObject(unwrappedValue);
-
-    if (unwrappedObject->inherits(&JSInspectedObjectWrapper::s_info))
-        return unwrappedObject;
-
-    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->lexicalGlobalObject()))
-        if (JSInspectedObjectWrapper* wrapper = wrapperMap->get(unwrappedObject))
-            return wrapper;
-
-    JSValue prototype = unwrappedObject->prototype();
-    ASSERT(prototype.isNull() || prototype.isObject());
-
-    if (prototype.isNull())
-        return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(jsNull()));
-    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
-}
-
-JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
-    : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
-{
-    WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
-    if (!wrapperMap) {
-        wrapperMap = new WrapperMap;
-        wrappers().set(unwrappedGlobalObject(), wrapperMap);
-    }
-
-    ASSERT(!wrapperMap->contains(unwrappedObject));
-    wrapperMap->set(unwrappedObject, this);
-}
-
-JSInspectedObjectWrapper::~JSInspectedObjectWrapper()
-{
-    ASSERT(wrappers().contains(unwrappedGlobalObject()));
-    WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
-
-    ASSERT(wrapperMap->contains(unwrappedObject()));
-    wrapperMap->remove(unwrappedObject());
-
-    if (wrapperMap->isEmpty()) {
-        wrappers().remove(unwrappedGlobalObject());
-        delete wrapperMap;
-    }
-}
-
-JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value) const
-{
-    // The Inspector is only allowed to pass primitive values and wrapped objects to objects from the inspected page.
-
-    if (!value.isObject())
-        return value;
-
-    JSQuarantinedObjectWrapper* wrapper = asWrapper(value);
-    ASSERT_WITH_MESSAGE(wrapper, "Objects passed to JSInspectedObjectWrapper must be wrapped");
-    if (!wrapper)
-        return jsUndefined();
-
-    if (wrapper->allowsUnwrappedAccessFrom(unwrappedExecState())) {
-        ASSERT_WITH_MESSAGE(wrapper->inherits(&s_info), "A wrapper contains an object from the inspected page but is not a JSInspectedObjectWrapper");
-        if (!wrapper->inherits(&s_info))
-            return jsUndefined();
-
-        // Return the unwrapped object so the inspected page never sees one of its own objects in wrapped form.
-        return wrapper->unwrappedObject();
-    }
-
-    ASSERT_WITH_MESSAGE(wrapper->inherits(&JSInspectorCallbackWrapper::s_info), "A wrapper that was not from the inspected page and is not an Inspector callback was passed to a JSInspectedObjectWrapper");
-    if (!wrapper->inherits(&JSInspectorCallbackWrapper::s_info))
-        return jsUndefined();
-
-    return wrapper;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
deleted file mode 100644
index ad97035..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JSInspectedObjectWrapper_h
-#define JSInspectedObjectWrapper_h
-
-#include "JSQuarantinedObjectWrapper.h"
-
-namespace WebCore {
-
-    class JSInspectedObjectWrapper : public JSQuarantinedObjectWrapper {
-    public:
-        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
-        virtual ~JSInspectedObjectWrapper();
-
-        static const JSC::ClassInfo s_info;
-
-    private:
-        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
-
-        virtual bool allowsGetProperty() const { return true; }
-        virtual bool allowsSetProperty() const { return true; }
-        virtual bool allowsDeleteProperty() const { return true; }
-        virtual bool allowsConstruct() const { return true; }
-        virtual bool allowsHasInstance() const { return true; }
-        virtual bool allowsCallAsFunction() const { return true; }
-        virtual bool allowsGetPropertyNames() const { return true; }
-
-        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
-        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
-
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-} // namespace WebCore
-
-#endif // JSInspectedObjectWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
deleted file mode 100644
index 439f532..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ /dev/null
@@ -1,346 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSInspectorBackend.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Console.h"
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "JSDatabase.h"
-#endif
-#include "ExceptionCode.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "InspectorBackend.h"
-#include "InspectorController.h"
-#include "InspectorResource.h"
-#include "JSDOMWindow.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSInspectorCallbackWrapper.h"
-#include "JSNode.h"
-#include "JSRange.h"
-#include "Node.h"
-#include "Page.h"
-#if ENABLE(DOM_STORAGE)
-#include "Storage.h"
-#include "JSStorage.h"
-#endif
-#include "TextIterator.h"
-#include "VisiblePosition.h"
-#include <runtime/JSArray.h>
-#include <runtime/JSLock.h>
-#include <wtf/Vector.h>
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "JavaScriptCallFrame.h"
-#include "JavaScriptDebugServer.h"
-#include "JSJavaScriptCallFrame.h"
-#endif
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    impl()->highlight(args.at(0).toInt32(exec));
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    Node* node = toNode(args.at(0));
-    if (!node)
-        return jsUndefined();
-
-    String target = args.at(1).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    MarkedArgumentBuffer result;
-    RefPtr<Range> searchRange(rangeOfContents(node));
-
-    ExceptionCode ec = 0;
-    do {
-        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
-        if (resultRange->collapsed(ec))
-            break;
-
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
-        result.append(toJS(exec, resultRange.get()));
-
-        setStart(searchRange.get(), newStart);
-    } while (true);
-
-    return constructArray(exec, result);
-}
-
-#if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-
-    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
-    if (!database)
-        return jsUndefined();
-    // Could use currentWorld(exec) ... but which exec!  The following mixed use of exec & inspectedWindow->globalExec() scares me!
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
-    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
-}
-#endif
-
-JSValue JSInspectorBackend::inspectedWindow(ExecState*, const ArgList&)
-{
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
-    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
-}
-
-JSValue JSInspectorBackend::setting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    const InspectorController::Setting& setting = ic->setting(key);
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            return jsUndefined();
-        case InspectorController::Setting::StringType:
-            return jsString(exec, setting.string());
-        case InspectorController::Setting::DoubleType:
-            return jsNumber(exec, setting.doubleValue());
-        case InspectorController::Setting::IntegerType:
-            return jsNumber(exec, setting.integerValue());
-        case InspectorController::Setting::BooleanType:
-            return jsBoolean(setting.booleanValue());
-        case InspectorController::Setting::StringVectorType: {
-            MarkedArgumentBuffer stringsArray;
-            const Vector<String>& strings = setting.stringVector();
-            const unsigned length = strings.size();
-            for (unsigned i = 0; i < length; ++i)
-                stringsArray.append(jsString(exec, strings[i]));
-            return constructArray(exec, stringsArray);
-        }
-    }
-}
-
-JSValue JSInspectorBackend::setSetting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController::Setting setting;
-
-    JSValue value = args.at(1);
-    if (value.isUndefined() || value.isNull()) {
-        // Do nothing. The setting is already NoType.
-        ASSERT(setting.type() == InspectorController::Setting::NoType);
-    } else if (value.isString())
-        setting.set(value.toString(exec));
-    else if (value.isNumber())
-        setting.set(value.toNumber(exec));
-    else if (value.isBoolean())
-        setting.set(value.toBoolean(exec));
-    else {
-        JSArray* jsArray = asArray(value);
-        if (!jsArray)
-            return jsUndefined();
-        Vector<String> strings;
-        for (unsigned i = 0; i < jsArray->length(); ++i) {
-            String item = jsArray->get(exec, i).toString(exec);
-            if (exec->hadException())
-                return jsUndefined();
-            strings.append(item);
-        }
-        setting.set(strings);
-    }
-
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (ic)
-        ic->setSetting(key, setting);
-
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::wrapCallback(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    return JSInspectorCallbackWrapper::wrap(exec, args.at(0));
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-
-JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
-{
-    JavaScriptCallFrame* callFrame = impl()->currentCallFrame();
-    if (!callFrame || !callFrame->isValid())
-        return jsUndefined();
-
-    // FIXME: I am not sure if this is actually needed. Can we just use exec?
-    ExecState* globalExec = callFrame->scopeChain()->globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
-}
-
-#endif
-
-JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
-    if (!node)
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
-    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
-}
-
-JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
-}
-
-JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
-}
-
-JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return jsUndefined();
-
-    bool selectInUI = args.at(1).toBoolean(exec);
-    return jsNumber(exec, impl()->pushNodePathToFrontend(node, selectInUI));
-}
-
-#if ENABLE(DATABASE)
-JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Database* database = toDatabase(wrapper->unwrappedObject());
-    if (database)
-        impl()->selectDatabase(database);
-    return jsUndefined();
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Storage* storage = toStorage(wrapper->unwrappedObject());
-    if (storage)
-        impl()->selectDOMStorage(storage);
-    return jsUndefined();
-}
-#endif
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
deleted file mode 100644
index 9c4330d..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSInspectorCallbackWrapper.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "JSInspectedObjectWrapper.h"
-#include <wtf/StdLibExtras.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper);
-
-typedef HashMap<JSObject*, JSInspectorCallbackWrapper*> WrapperMap;
-
-static WrapperMap& wrappers()
-{
-    DEFINE_STATIC_LOCAL(WrapperMap, map, ());
-    return map;
-}
-
-const ClassInfo JSInspectorCallbackWrapper::s_info = { "JSInspectorCallbackWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
-
-static Structure* leakInspectorCallbackWrapperStructure()
-{
-    Structure::startIgnoringLeaks();
-    Structure* structure = JSInspectorCallbackWrapper::createStructure(jsNull()).releaseRef();
-    Structure::stopIgnoringLeaks();
-    return structure;
-}
-
-JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
-{
-    if (!unwrappedValue.isObject())
-        return unwrappedValue;
-
-    JSObject* unwrappedObject = asObject(unwrappedValue);
-
-    if (unwrappedObject->inherits(&JSInspectorCallbackWrapper::s_info))
-        return unwrappedObject;
-
-    if (JSInspectorCallbackWrapper* wrapper = wrappers().get(unwrappedObject))
-        return wrapper;
-
-    JSValue prototype = unwrappedObject->prototype();
-    ASSERT(prototype.isNull() || prototype.isObject());
-
-    if (prototype.isNull()) {
-        static Structure* structure = leakInspectorCallbackWrapperStructure();
-        return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
-    }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
-}
-
-JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
-    : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
-{
-    ASSERT(!wrappers().contains(unwrappedObject));
-    wrappers().set(unwrappedObject, this);
-}
-
-JSInspectorCallbackWrapper::~JSInspectorCallbackWrapper()
-{
-    wrappers().remove(unwrappedObject());
-}
-
-JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValue unwrappedValue) const
-{
-    if (JSQuarantinedObjectWrapper* wrapper = asWrapper(unwrappedValue)) {
-        // The only time a wrapper should be passed into a JSInspectorCallbackWrapper is when a client-side storage callback
-        // is called. (The client-side storage API calls the callback with the `this` object set to the callback itself.)
-        ASSERT_WITH_MESSAGE(wrapper == this, "A different wrapper was passed into a JSInspectorCallbackWrapper");
-        if (wrapper != this)
-            return jsUndefined();
-
-        return wrapper->unwrappedObject();
-    }
-
-    // Any value being passed to the Inspector from the inspected page should be wrapped in a JSInspectedObjectWrapper.
-    return JSInspectedObjectWrapper::wrap(unwrappedExec, unwrappedValue);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
deleted file mode 100644
index be28063..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JSInspectorCallbackWrapper_h
-#define JSInspectorCallbackWrapper_h
-
-#include "JSQuarantinedObjectWrapper.h"
-
-namespace WebCore {
-
-    class JSInspectorCallbackWrapper : public JSQuarantinedObjectWrapper {
-    public:
-        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
-
-        virtual ~JSInspectorCallbackWrapper();
-
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-        static const JSC::ClassInfo s_info;
-
-    protected:
-        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
-
-        virtual bool allowsCallAsFunction() const { return true; }
-
-        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
-        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
-    };
-
-} // namespace WebCore
-
-#endif // JSInspectorCallbackWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
new file mode 100644
index 0000000..7b06bac
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectorFrontendHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ContextMenuItem.h"
+#include "InspectorController.h"
+#include "InspectorFrontendHost.h"
+#include "JSEvent.h"
+#include "MouseEvent.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <runtime/JSObject.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSInspectorFrontendHost::showContextMenu(ExecState* execState, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Event* event = toEvent(args.at(0));
+
+    JSArray* array = asArray(args.at(1));
+    Vector<ContextMenuItem*> items;
+
+    for (size_t i = 0; i < array->length(); ++i) {
+        JSObject* item = asObject(array->getIndex(i));
+        JSValue label = item->get(execState, Identifier(execState, "label"));
+        JSValue id = item->get(execState, Identifier(execState, "id"));
+        if (label.isUndefined() || id.isUndefined())
+            items.append(new ContextMenuItem(SeparatorType, ContextMenuItemTagNoAction, String()));
+        else {
+            ContextMenuAction typedId = static_cast<ContextMenuAction>(ContextMenuItemBaseCustomTag + id.toInt32(execState));
+            items.append(new ContextMenuItem(ActionType, typedId, label.toString(execState)));
+        }
+    }
+
+    impl()->showContextMenu(event, items);
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index 08ecf2b..afbdf5d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -55,9 +55,9 @@ JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
 {
     switch (impl()->type()) {
         case DebuggerCallFrame::FunctionType:
-            return jsString(exec, "function");
+            return jsString(exec, UString("function"));
         case DebuggerCallFrame::ProgramType:
-            return jsString(exec, "program");
+            return jsString(exec, UString("program"));
     }
 
     ASSERT_NOT_REACHED();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
index 6d75f4f..cd1d267 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -35,12 +35,11 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
 #endif
 
-JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
-    : JSEventListener(0, true, isolatedWorld)
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, JSObject* wrapper, DOMWrapperWorld* isolatedWorld)
+    : JSEventListener(0, wrapper, true, isolatedWorld)
     , m_functionName(functionName)
     , m_eventParameterName(eventParameterName)
     , m_code(code)
-    , m_parsed(false)
     , m_sourceURL(sourceURL)
     , m_lineNumber(lineNumber)
     , m_originalNode(node)
@@ -48,8 +47,8 @@ JSLazyEventListener::JSLazyEventListener(const String& functionName, const Strin
     // We don't retain the original node because we assume it
     // will stay alive as long as this handler object is around
     // and we need to avoid a reference cycle. If JS transfers
-    // this handler to another node, parseCode will be called and
-    // then originalNode is no longer needed.
+    // this handler to another node, initializeJSFunction will
+    // be called and then originalNode is no longer needed.
 
     // A JSLazyEventListener can be created with a line number of zero when it is created with
     // a setAttribute call from JavaScript, so make the line number 1 in that case.
@@ -68,79 +67,62 @@ JSLazyEventListener::~JSLazyEventListener()
 #endif
 }
 
-JSObject* JSLazyEventListener::jsFunction(ScriptExecutionContext* executionContext) const
-{
-    parseCode(executionContext);
-    return m_jsFunction;
-}
-
-void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) const
+JSObject* JSLazyEventListener::initializeJSFunction(ScriptExecutionContext* executionContext) const
 {
     ASSERT(executionContext);
     ASSERT(executionContext->isDocument());
     if (!executionContext)
-        return;
-
-    if (m_parsed)
-        return;
+        return 0;
 
     Frame* frame = static_cast<Document*>(executionContext)->frame();
     if (!frame)
-        return;
+        return 0;
 
     ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
-        return;
+    if (!scriptController->canExecuteScripts(AboutToExecuteScript))
+        return 0;
 
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, m_isolatedWorld.get());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, isolatedWorld());
     if (!globalObject)
-        return;
-
-    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
-    if (m_originalNode) {
-        JSLock lock(SilenceAssertionsOnly);
-        // FIXME: Should pass the global object associated with the node
-        toJS(globalObject->globalExec(), globalObject, m_originalNode);
-    }
+        return 0;
 
     if (executionContext->isDocument()) {
         JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
         Frame* frame = window->impl()->frame();
         if (!frame)
-            return;
+            return 0;
         // FIXME: Is this check needed for non-Document contexts?
         ScriptController* script = frame->script();
-        if (!script->isEnabled() || script->isPaused())
-            return;
+        if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
+            return 0;
     }
 
-    m_parsed = true;
-
     ExecState* exec = globalObject->globalExec();
 
     MarkedArgumentBuffer args;
     args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
-    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), m_sourceURL, m_lineNumber); // FIXME: is globalExec ok?
-
-    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
-
+    JSObject* jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), m_sourceURL, m_lineNumber); // FIXME: is globalExec ok?
     if (exec->hadException()) {
         exec->clearException();
+        return 0;
+    }
+
+    JSFunction* listenerAsFunction = static_cast<JSFunction*>(jsFunction);
+    if (m_originalNode) {
+        if (!wrapper()) {
+            // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+            JSLock lock(SilenceAssertionsOnly);
+            // FIXME: Should pass the global object associated with the node
+            setWrapper(asObject(toJS(globalObject->globalExec(), globalObject, m_originalNode)));
+        }
 
-        // failed to parse, so let's just make this listener a no-op
-        m_jsFunction = 0;
-    } else if (m_originalNode) {
         // Add the event's home element to the scope
         // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
         ScopeChain scope = listenerAsFunction->scope();
-
-        JSValue thisObj = toJS(exec, globalObject, m_originalNode);
-        if (thisObj.isObject()) {
-            static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
-            listenerAsFunction->setScope(scope);
-        }
+        static_cast<JSNode*>(wrapper())->pushEventHandlerScope(exec, scope);
+        listenerAsFunction->setScope(scope);
     }
 
     // Since we only parse once, there's no need to keep data used for parsing around anymore.
@@ -148,6 +130,7 @@ void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) co
     m_code = String();
     m_eventParameterName = String();
     m_sourceURL = String();
+    return jsFunction;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
index ba26ef6..1b00b75 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
@@ -29,24 +29,21 @@ namespace WebCore {
 
     class JSLazyEventListener : public JSEventListener {
     public:
-        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, JSC::JSObject* wrapper, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber, isolatedWorld));
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber, wrapper, isolatedWorld));
         }
         virtual ~JSLazyEventListener();
 
     private:
-        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld);
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber, JSC::JSObject* wrapper, DOMWrapperWorld* isolatedWorld);
 
-        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
+        virtual JSC::JSObject* initializeJSFunction(ScriptExecutionContext*) const;
         virtual bool wasCreatedFromMarkup() const { return true; }
 
-        void parseCode(ScriptExecutionContext*) const;
-
         mutable String m_functionName;
         mutable String m_eventParameterName;
         mutable String m_code;
-        mutable bool m_parsed;
         mutable String m_sourceURL;
         int m_lineNumber;
         Node* m_originalNode;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index c76a2b1..a3e2bae 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -24,6 +24,7 @@
 #include "JSLocationCustom.h"
 
 #include "DOMWindow.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "JSDOMBinding.h"
@@ -38,17 +39,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionReplace);
 }
 
-static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsLocationPrototypeFunctionReload);
 }
 
-static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionAssign);
 }
@@ -102,14 +103,9 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
         return true;
     }
     
-    // When accessing Location cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, frame, message))
-        return false;
+    // throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, frame))
+        return true;
     
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -133,8 +129,7 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
     // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
     // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
     // such cases when normally the string form of Location would be the URL.
-    
-    printErrorMessageForFrame(frame, message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -174,12 +169,12 @@ bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
@@ -220,7 +215,10 @@ void JSLocation::setProtocol(ExecState* exec, JSValue value)
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setProtocol(value.toString(exec));
+    if (!url.setProtocol(value.toString(exec))) {
+        setDOMException(exec, SYNTAX_ERR);
+        return;
+    }
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
@@ -257,8 +255,9 @@ void JSLocation::setPort(ExecState* exec, JSValue value)
     const UString& portString = value.toString(exec);
     int port = charactersToInt(portString.data(), portString.size());
     if (port < 0 || port > 0xFFFF)
-        port = 0;
-    url.setPort(port);
+        url.removePort();
+    else
+        url.setPort(port);
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index 2c09620..2ee8125 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -49,7 +49,7 @@ void JSMessagePort::markChildren(MarkStack& markStack)
     if (MessagePort* entangledPort = m_impl->locallyEntangledPort())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), entangledPort);
 
-    m_impl->markEventListeners(markStack);
+    m_impl->markJSEventListeners(markStack);
 }
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
@@ -58,7 +58,7 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -68,7 +68,7 @@ JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
index c90dadd..c4b3189 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
@@ -33,9 +33,9 @@ bool JSMimeTypeArray::canGetItemsForName(ExecState*, MimeTypeArray* mimeTypeArra
     return mimeTypeArray->canGetItemsForName(propertyName);
 }
 
-JSValue JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMimeTypeArray::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
+    JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 1974ab0..13f3628 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -40,9 +40,9 @@ bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Id
     return impl->getNamedItem(propertyName);
 }
 
-JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNamedNodeMap::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
+    JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
 }
 
@@ -52,10 +52,8 @@ void JSNamedNodeMap::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->element()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->element())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 2a4aa80..134c581 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -114,7 +114,7 @@ JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -124,7 +124,7 @@ JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -137,42 +137,45 @@ void JSNode::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     Node* node = m_impl.get();
-    node->markEventListeners(markStack);
+    node->markJSEventListeners(markStack);
 
     // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
     // the document, we need to mark the document, but we don't need to explicitly
     // mark any other nodes.
     if (node->inDocument()) {
         if (Document* doc = node->ownerDocument())
-            markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), doc);
+            markDOMNodeWrapper(markStack, doc, doc);
         return;
     }
 
-    // This is a node outside the document, so find the root of the tree it is in,
-    // and start marking from there.
+    // This is a node outside the document.
+    // Find the the root, and the highest ancestor with a wrapper.
     Node* root = node;
-    for (Node* current = m_impl.get(); current; current = current->parentNode())
+    Node* outermostNodeWithWrapper = node;
+    for (Node* current = m_impl.get(); current; current = current->parentNode()) {
         root = current;
+        if (hasCachedDOMNodeWrapperUnchecked(current->document(), current))
+            outermostNodeWithWrapper = current;
+    }
 
-    // Nodes in a subtree are marked by the tree's root, so, if the root is already
-    // marking the tree, we don't need to explicitly mark any other nodes.
-    if (root->inSubtreeMark())
+    // Only nodes that have no ancestors with wrappers mark the subtree. In the common
+    // case, the root of the detached subtree has a wrapper, so the tree will only
+    // get marked once. Nodes that aren't outermost need to mark the outermost
+    // in case it is otherwise unreachable.
+    if (node != outermostNodeWithWrapper) {
+        markDOMNodeWrapper(markStack, m_impl->document(), outermostNodeWithWrapper);
         return;
+    }
 
     // Mark the whole tree subtree.
-    root->setInSubtreeMark(true);
-    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
-        JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
-    root->setInSubtreeMark(false);
+    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode())
+        markDOMNodeWrapper(markStack, m_impl->document(), nodeToMark);
 }
 
-static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+static ALWAYS_INLINE JSValue createWrapperInline(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
     ASSERT(node);
-    ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+    ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
     
     JSNode* wrapper;    
     switch (node->nodeType()) {
@@ -225,25 +228,18 @@ static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* g
 
     return wrapper;    
 }
-    
-JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+
+JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
-    if (!node)
-        return jsNull();
-    
-    return createWrapper(exec, globalObject, node);
+    return createWrapperInline(exec, globalObject, node);
 }
     
-JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
     if (!node)
         return jsNull();
-
-    JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node);
-    if (wrapper)
-        return wrapper;
-
-    return createWrapper(exec, globalObject, node);
+    
+    return createWrapperInline(exec, globalObject, node);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.h
new file mode 100644
index 0000000..9d06ae6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSNodeCustom_h
+#define JSNodeCustom_h
+
+#include "JSDOMBinding.h"
+#include <wtf/AlwaysInline.h>
+
+namespace WebCore {
+
+inline JSNode* getCachedDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node)
+{
+    if (currentWorld(exec)->isNormal()) {
+        ASSERT(node->wrapper() == (document ? document->getWrapperCache(currentWorld(exec))->get(node) : domObjectWrapperMapFor(exec).get(node)));
+        return static_cast<JSNode*>(node->wrapper());
+    }
+
+    if (document)
+        return document->getWrapperCache(currentWorld(exec))->get(node);
+    return static_cast<JSNode*>(domObjectWrapperMapFor(exec).get(node));
+}
+
+JSC::JSValue createWrapper(JSC::ExecState*, JSDOMGlobalObject*, Node*);
+
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+{
+    if (!node)
+        return JSC::jsNull();
+
+    JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node);
+    if (wrapper)
+        return wrapper;
+
+    return createWrapper(exec, globalObject, node);
+}
+
+}
+
+#endif // JSDOMNodeCustom_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 54dc020..d34f5c1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -66,7 +66,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValue result = callInWorld(exec, m_filter, callType, callData, m_filter, args, currentWorld(exec));
+    JSValue result = JSC::call(exec, m_filter, callType, callData, m_filter, args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
index 2821d01..3f7d08b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -56,9 +56,9 @@ bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, const Identifier
     return impl->itemWithName(propertyName);
 }
 
-JSValue JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNodeList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
+    JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->itemWithName(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
index 7da0666..995903e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -49,21 +49,18 @@ static JSObject* constructHTMLOptionElement(ExecState* exec, JSObject* construct
     if (!document)
         return throwError(exec, ReferenceError, "Option constructor associated document is unavailable");
 
-    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement(HTMLNames::optionTag, false));
-
-    ExceptionCode ec = 0;
-    RefPtr<Text> text = document->createTextNode("");
+    String data;
     if (!args.at(0).isUndefined())
-        text->setData(args.at(0).toString(exec), ec);
-    if (ec == 0)
-        element->appendChild(text.release(), ec);
-    if (ec == 0 && !args.at(1).isUndefined())
-        element->setValue(args.at(1).toString(exec));
-    if (ec == 0)
-        element->setDefaultSelected(args.at(2).toBoolean(exec));
-    if (ec == 0)
-        element->setSelected(args.at(3).toBoolean(exec));
+        data = args.at(0).toString(exec);
 
+    String value;
+    if (!args.at(1).isUndefined())
+        value = args.at(1).toString(exec);
+    bool defaultSelected = args.at(2).toBoolean(exec);
+    bool selected = args.at(3).toBoolean(exec);
+
+    ExceptionCode ec = 0;
+    RefPtr<HTMLOptionElement> element = HTMLOptionElement::createForJSConstructor(document, data, value, defaultSelected, selected, ec);
     if (ec) {
         setDOMException(exec, ec);
         return 0;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
index 81d4295..9e0c3f5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
@@ -33,9 +33,9 @@ bool JSPluginArray::canGetItemsForName(ExecState*, PluginArray* pluginArray, con
     return pluginArray->canGetItemsForName(propertyName);
 }
 
-JSValue JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPluginArray::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
+    JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
index 555dd9e..b29e583 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
@@ -32,9 +32,9 @@ bool JSPlugin::canGetItemsForName(ExecState*, Plugin* plugin, const Identifier&
     return plugin->canGetItemsForName(propertyName);
 }
 
-JSValue JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPlugin::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
+    JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
index ada2a77..b20b9a7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -20,10 +20,10 @@
 #include "config.h"
 #include "JSPluginElementFunctions.h"
 
+#include "Bridge.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
 #include "JSHTMLElement.h"
-#include "runtime.h"
 #include "runtime_object.h"
 
 using namespace JSC;
@@ -35,7 +35,7 @@ using namespace HTMLNames;
 
 // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
 
-static Instance* pluginInstance(Node* node)
+Instance* pluginInstance(Node* node)
 {
     if (!node)
         return 0;
@@ -49,7 +49,7 @@ static Instance* pluginInstance(Node* node)
     return instance;
 }
 
-static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
+static RuntimeObject* getRuntimeObject(ExecState* exec, Node* node)
 {
     Instance* instance = pluginInstance(node);
     if (!instance)
@@ -57,19 +57,11 @@ static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
     return instance->createRuntimeObject(exec);
 }
 
-JSValue runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue runtimeObjectPropertyGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slotBase));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
-    return runtimeObject ? runtimeObject : jsUndefined();
-}
-
-JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
-    HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
         return jsUndefined();
     return runtimeObject->get(exec, propertyName);
@@ -77,7 +69,7 @@ JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyN
 
 bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot, JSHTMLElement* element)
 {
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element->impl());
     if (!runtimeObject)
         return false;
     if (!runtimeObject->hasProperty(exec, propertyName))
@@ -88,7 +80,7 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
 
 bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
 {
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element->impl());
     if (!runtimeObject)
         return false;
     if (!runtimeObject->hasProperty(exec, propertyName))
@@ -104,7 +96,7 @@ bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifi
 
 bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
         return 0;
     if (!runtimeObject->hasProperty(exec, propertyName))
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
index a5a323a..736ace9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -22,6 +22,12 @@
 
 #include "JSDOMBinding.h"
 
+namespace JSC {
+namespace Bindings {
+class Instance;
+}
+}
+
 namespace WebCore {
 
     class HTMLElement;
@@ -29,9 +35,9 @@ namespace WebCore {
     class Node;
 
     // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
+    JSC::Bindings::Instance* pluginInstance(Node*);
 
-    JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
     bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, JSHTMLElement*);
     bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPopStateEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPopStateEventCustom.cpp
new file mode 100644
index 0000000..3f5fd7e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPopStateEventCustom.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "JSPopStateEvent.h"
+
+#include "PopStateEvent.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSPopStateEvent::initPopStateEvent(ExecState* exec, const ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    RefPtr<SerializedScriptValue> stateObjectArg = SerializedScriptValue::create(exec, args.at(3));
+    
+    PopStateEvent* event = static_cast<PopStateEvent*>(impl());
+    event->initPopStateEvent(typeArg, canBubbleArg, cancelableArg, stateObjectArg.release());
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
deleted file mode 100644
index 2ab2c00..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ /dev/null
@@ -1,336 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSQuarantinedObjectWrapper.h"
-
-#include "JSDOMBinding.h"
-
-#include <runtime/JSGlobalObject.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper);
-
-const ClassInfo JSQuarantinedObjectWrapper::s_info = { "JSQuarantinedObjectWrapper", 0, 0, 0 };
-
-JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValue value)
-{
-    if (!value.isObject())
-        return 0;
-
-    JSObject* object = asObject(value);
-
-    if (!object->inherits(&JSQuarantinedObjectWrapper::s_info))
-        return 0;
-
-    return static_cast<JSQuarantinedObjectWrapper*>(object);
-}
-
-JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
-{
-    JSValue v = slot.slotBase();
-    ASSERT(v);
-    return v;
-}
-
-JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
-    : JSObject(structure)
-    , m_unwrappedGlobalObject(unwrappedExec->lexicalGlobalObject())
-    , m_unwrappedObject(unwrappedObject)
-{
-    ASSERT_ARG(unwrappedExec, unwrappedExec);
-    ASSERT_ARG(unwrappedObject, unwrappedObject);
-    ASSERT(this->structure());
-}
-
-JSQuarantinedObjectWrapper::~JSQuarantinedObjectWrapper()
-{
-}
-
-bool JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom(ExecState* exec) const
-{
-    return m_unwrappedGlobalObject->profileGroup() == exec->lexicalGlobalObject()->profileGroup();
-}
-
-ExecState* JSQuarantinedObjectWrapper::unwrappedExecState() const
-{
-    return m_unwrappedGlobalObject->globalExec();
-}
-
-void JSQuarantinedObjectWrapper::transferExceptionToExecState(ExecState* exec) const
-{
-    ASSERT(exec != unwrappedExecState());
-
-    if (!unwrappedExecState()->hadException())
-        return;
-
-    JSValue exception = unwrappedExecState()->exception();
-    unwrappedExecState()->clearException();
-    exec->setException(wrapOutgoingValue(unwrappedExecState(), exception));
-}
-
-void JSQuarantinedObjectWrapper::markChildren(MarkStack& markStack)
-{
-    JSObject::markChildren(markStack);
-
-    markStack.append(m_unwrappedObject);
-    markStack.append(m_unwrappedGlobalObject);
-}
-
-bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, const Identifier& identifier, PropertySlot& slot)
-{
-    if (!allowsGetProperty()) {
-        slot.setUndefined();
-        return true;
-    }
-
-    PropertySlot unwrappedSlot(m_unwrappedObject);
-    bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
-    if (result) {
-        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
-        slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
-    }
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySlot& slot)
-{
-    if (!allowsGetProperty()) {
-        slot.setUndefined();
-        return true;
-    }
-
-    PropertySlot unwrappedSlot(m_unwrappedObject);
-    bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
-    if (result) {
-        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
-        slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
-    }
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::getOwnPropertyDescriptor(ExecState* exec, const Identifier& identifier, PropertyDescriptor& descriptor)
-{
-    if (!allowsGetProperty()) {
-        descriptor.setUndefined();
-        return true;
-    }
-
-    PropertyDescriptor unwrappedDescriptor;
-    bool result = m_unwrappedObject->getOwnPropertyDescriptor(unwrappedExecState(), identifier, unwrappedDescriptor);
-
-    if (unwrappedDescriptor.isAccessorDescriptor()) {
-        descriptor.setAccessorDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.getter()),
-                                         wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.setter()),
-                                         unwrappedDescriptor.attributes());
-    } else
-        descriptor.setDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.value()), unwrappedDescriptor.attributes());
-    transferExceptionToExecState(exec);
-    return result;
-}
-
-void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
-{
-    if (!allowsSetProperty())
-        return;
-
-    m_unwrappedObject->put(unwrappedExecState(), identifier, prepareIncomingValue(exec, value), slot);
-
-    transferExceptionToExecState(exec);
-}
-
-void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValue value)
-{
-    if (!allowsSetProperty())
-        return;
-
-    m_unwrappedObject->put(unwrappedExecState(), identifier, prepareIncomingValue(exec, value));
-
-    transferExceptionToExecState(exec);
-}
-
-bool JSQuarantinedObjectWrapper::defineOwnProperty(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
-{
-    if (!allowsSetProperty())
-        return false;
-
-    PropertyDescriptor wrappedDescriptor;
-    if (descriptor.isDataDescriptor()) {
-        wrappedDescriptor.setValue(prepareIncomingValue(exec, descriptor.value()));
-        if (wrappedDescriptor.writablePresent())
-            wrappedDescriptor.setWritable(descriptor.writable());
-    } else if (descriptor.isAccessorDescriptor()) {
-        if (descriptor.getter())
-            wrappedDescriptor.setGetter(prepareIncomingValue(exec, descriptor.getter()));
-        if (descriptor.setter())
-            wrappedDescriptor.setSetter(prepareIncomingValue(exec, descriptor.setter()));
-    }
-    if (wrappedDescriptor.enumerablePresent())
-        wrappedDescriptor.setEnumerable(descriptor.enumerable());
-    if (wrappedDescriptor.configurablePresent())
-        wrappedDescriptor.setConfigurable(descriptor.configurable());
-    
-    bool result = m_unwrappedObject->defineOwnProperty(unwrappedExecState(), propertyName, wrappedDescriptor, shouldThrow);
-    
-    transferExceptionToExecState(exec);
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
-{
-    if (!allowsDeleteProperty())
-        return false;
-
-    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, unsigned identifier)
-{
-    if (!allowsDeleteProperty())
-        return false;
-
-    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(constructor);
-
-    MarkedArgumentBuffer preparedArgs;
-    for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
-
-    // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getConstructData
-    // from when we called it in JSQuarantinedObjectWrapper::getConstructData.
-    ConstructData unwrappedConstructData;
-    ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
-    ASSERT(unwrappedConstructType != ConstructTypeNone);
-
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = constructInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs, debuggerWorld());
-
-    JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
-    ASSERT(resultValue.isObject());
-    JSObject* result = asObject(resultValue);
-
-    wrapper->transferExceptionToExecState(exec);
-
-    return result;
-}
-
-ConstructType JSQuarantinedObjectWrapper::getConstructData(ConstructData& constructData)
-{
-    if (!allowsConstruct())
-        return ConstructTypeNone;
-    ConstructData unwrappedConstructData;
-    if (m_unwrappedObject->getConstructData(unwrappedConstructData) == ConstructTypeNone)
-        return ConstructTypeNone;
-    constructData.native.function = construct;
-    return ConstructTypeHost;
-}
-
-bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValue value, JSValue proto)
-{
-    if (!allowsHasInstance())
-        return false;
-
-    bool result = m_unwrappedObject->hasInstance(unwrappedExecState(), prepareIncomingValue(exec, value), prepareIncomingValue(exec, proto));
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
-{
-    JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(function);
-
-    JSValue preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
-
-    MarkedArgumentBuffer preparedArgs;
-    for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
-
-    // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getCallData
-    // from when we called it in JSQuarantinedObjectWrapper::getCallData.
-    CallData unwrappedCallData;
-    CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
-    ASSERT(unwrappedCallType != CallTypeNone);
-
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = callInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs, debuggerWorld());
-
-    JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
-
-    wrapper->transferExceptionToExecState(exec);
-
-    return result;
-}
-
-CallType JSQuarantinedObjectWrapper::getCallData(CallData& callData)
-{
-    if (!allowsCallAsFunction())
-        return CallTypeNone;
-    CallData unwrappedCallData;
-    if (m_unwrappedObject->getCallData(unwrappedCallData) == CallTypeNone)
-        return CallTypeNone;
-    callData.native.function = call;
-    return CallTypeHost;
-}
-
-void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray& array)
-{
-    if (!allowsGetPropertyNames())
-        return;
-    
-    m_unwrappedObject->getPropertyNames(unwrappedExecState(), array);
-}
-
-void JSQuarantinedObjectWrapper::getOwnPropertyNames(ExecState*, PropertyNameArray& array)
-{
-    if (!allowsGetPropertyNames())
-        return;
-
-    m_unwrappedObject->getOwnPropertyNames(unwrappedExecState(), array);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
deleted file mode 100644
index 9f62495..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JSQuarantinedObjectWrapper_h
-#define JSQuarantinedObjectWrapper_h
-
-#include <runtime/JSObject.h>
-
-namespace WebCore {
-
-    class JSQuarantinedObjectWrapper : public JSC::JSObject {
-    public:
-        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValue);
-
-        virtual ~JSQuarantinedObjectWrapper();
-
-        virtual JSC::JSObject* unwrappedObject() { return m_unwrappedObject; }
-
-        JSC::JSGlobalObject* unwrappedGlobalObject() const { return m_unwrappedGlobalObject; };
-        JSC::ExecState* unwrappedExecState() const;
-
-        bool allowsUnwrappedAccessFrom(JSC::ExecState*) const;
-
-        static const JSC::ClassInfo s_info;
-
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
-        { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
-        }
-
-    protected:
-        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | JSC::OverridesHasInstance | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::JSObject::StructureFlags;
-
-        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
-
-        virtual void markChildren(JSC::MarkStack&);
-
-    private:
-        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-        virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
-        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-
-        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
-        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
-
-        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
-        virtual bool deleteProperty(JSC::ExecState*, unsigned);
-
-        virtual JSC::CallType getCallData(JSC::CallData&);
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-
-        virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
-        
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-
-        virtual JSC::UString className() const { return m_unwrappedObject->className(); }
-
-        virtual bool allowsGetProperty() const { return false; }
-        virtual bool allowsSetProperty() const { return false; }
-        virtual bool allowsDeleteProperty() const { return false; }
-        virtual bool allowsConstruct() const { return false; }
-        virtual bool allowsHasInstance() const { return false; }
-        virtual bool allowsCallAsFunction() const { return false; }
-        virtual bool allowsGetPropertyNames() const { return false; }
-
-        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
-        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
-
-        static JSC::JSValue cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        void transferExceptionToExecState(JSC::ExecState*) const;
-
-        static JSC::JSValue JSC_HOST_CALL call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValue thisValue, const JSC::ArgList&);
-        static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
-
-        JSC::JSGlobalObject* m_unwrappedGlobalObject;
-        JSC::JSObject* m_unwrappedObject;
-    };
-
-} // namespace WebCore
-
-#endif // JSQuarantinedObjectWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGContextCache.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGContextCache.h
new file mode 100644
index 0000000..75ed324
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGContextCache.h
@@ -0,0 +1,97 @@
+/*
+    Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSSVGContextCache_h
+#define JSSVGContextCache_h
+
+#if ENABLE(SVG)
+#include "SVGElement.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+class DOMObject;
+
+class JSSVGContextCache : public Noncopyable {
+public:
+    typedef HashMap<DOMObject*, SVGElement*> WrapperMap;
+
+    static WrapperMap& wrapperMap()
+    {
+        DEFINE_STATIC_LOCAL(WrapperMap, s_wrapperMap, ());
+        return s_wrapperMap;
+    }
+
+    static void addWrapper(DOMObject* wrapper, SVGElement* context)
+    {
+        ASSERT(wrapper);
+        ASSERT(context);
+
+        pair<WrapperMap::iterator, bool> result = wrapperMap().add(wrapper, context);
+        if (result.second) {
+            WrapperMap::iterator& it = result.first;
+            ASSERT_UNUSED(it, it->second == context);
+        }
+    }
+
+    static void forgetWrapper(DOMObject* wrapper)
+    {
+        ASSERT(wrapper);
+
+        WrapperMap& map = wrapperMap();
+        WrapperMap::iterator it = map.find(wrapper);
+        if (it == map.end())
+            return;
+
+        map.remove(it);
+    }
+
+    static void propagateSVGDOMChange(DOMObject* wrapper, const QualifiedName& attributeName)
+    {
+        WrapperMap& map = wrapperMap();
+        WrapperMap::iterator it = map.find(wrapper);
+        if (it == map.end())
+            return;
+
+        SVGElement* context = it->second;
+        ASSERT(context);
+
+        context->svgAttributeChanged(attributeName);
+    }
+
+    static SVGElement* svgContextForDOMObject(DOMObject* wrapper)
+    {
+        ASSERT(wrapper);
+
+        WrapperMap& map = wrapperMap();
+        WrapperMap::iterator it = map.find(wrapper);
+        if (it == map.end())
+            return 0;
+
+        SVGElement* context = it->second;
+        ASSERT(context);
+        return context;
+    }
+
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index ba1cf22..b3bded5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -43,9 +43,7 @@ void JSSVGElementInstance::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     // Mark the wrapper for our corresponding element, so it can mark its event handlers.
-    JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
-    if (correspondingWrapper)
-        markStack.append(correspondingWrapper);
+    markDOMNodeWrapper(markStack, impl()->correspondingElement()->document(), impl()->correspondingElement());
 }
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
@@ -54,7 +52,7 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -64,7 +62,7 @@ JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
index bad52ae..33bbf30 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
@@ -28,18 +28,22 @@ namespace WebCore {
 
 JSValue JSSVGLength::value(ExecState* exec) const
 {
-    SVGLength imp(*impl());
-    return jsNumber(exec, imp.value(context()));
+    JSSVGPODTypeWrapper<SVGLength>* imp = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(const_cast<JSSVGLength*>(this));
+
+    SVGLength podImp(*imp);
+    return jsNumber(exec, podImp.value(context));
 }
 
 JSValue JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
 {
-    JSSVGPODTypeWrapper<SVGLength>* wrapper = impl();
+    JSSVGPODTypeWrapper<SVGLength>* imp = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    SVGLength imp(*wrapper);
-    imp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context());
+    SVGLength podImp(*imp);
+    podImp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context);
 
-    wrapper->commitChange(imp, context());
+    imp->commitChange(podImp, this);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
index 35390b2..59e3f03 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2009 Jeff Schiller <codedread@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,17 +23,37 @@
 #if ENABLE(SVG)
 #include "JSSVGMatrix.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "SVGException.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
+JSValue JSSVGMatrix::multiply(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    if (!args.at(0).inherits(&JSSVGMatrix::s_info))
+        return throwError(exec, TypeError, "secondMatrix argument was not a SVGMatrix");
+
+    JSSVGMatrix* matrixObj = static_cast<JSSVGMatrix*>(asObject(args.at(0)));
+
+    AffineTransform m1(*impl());
+    AffineTransform m2(*(matrixObj->impl()));
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
+    return toJS(exec, globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(m1.multLeft(m2)).get(), context);
+}
+
 JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 {
-    TransformationMatrix imp(*impl());
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
+    AffineTransform imp(*impl());
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
+    JSValue result = toJS(exec, globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.inverse()).get(), context);
 
     if (!imp.isInvertible())
         setDOMException(exec, SVGException::SVG_MATRIX_NOT_INVERTABLE);
@@ -42,12 +63,13 @@ JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 
 JSValue JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
 {
-    TransformationMatrix imp(*impl());
+    AffineTransform imp(*impl());
  
     float x = args.at(0).toFloat(exec);
     float y = args.at(1).toFloat(exec);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
+    JSValue result = toJS(exec, globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.rotateFromVector(x, y)).get(), context);
 
     if (x == 0.0 || y == 0.0)
         setDOMException(exec, SVGException::SVG_INVALID_VALUE_ERR);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODListCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODListCustom.h
new file mode 100644
index 0000000..8a0654c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODListCustom.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef JSSVGPODListCustom_h
+#define JSSVGPODListCustom_h
+
+#include "JSSVGContextCache.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGList.h"
+
+namespace WebCore {
+
+namespace JSSVGPODListCustom {
+
+// Helper structure only containing public typedefs, as C++ does not allow templatized typedefs
+template<typename PODType>
+struct JSSVGPODListTraits { 
+    typedef SVGPODListItem<PODType> PODListItem;
+    typedef SVGList<RefPtr<PODListItem> > PODList;
+    typedef PODType (*ConversionCallback)(JSC::JSValue);
+};
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue finishGetter(JSC::ExecState* exec, ExceptionCode& ec, JSPODListType* wrapper,
+                                 PassRefPtr<typename JSSVGPODListTraits<PODType>::PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+    
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(wrapper);
+    return toJS(exec, wrapper->globalObject(),
+                JSSVGPODTypeWrapperCreatorForList<PODType>::create(item.get(), listImp->associatedAttributeName()).get(), context);
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue finishSetter(JSC::ExecState* exec, ExceptionCode& ec, JSPODListType* wrapper,                                
+                                 PassRefPtr<typename JSSVGPODListTraits<PODType>::PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+
+    const QualifiedName& attributeName = listImp->associatedAttributeName();
+    JSSVGContextCache::propagateSVGDOMChange(wrapper, attributeName);
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(wrapper);
+    return toJS(exec, wrapper->globalObject(),
+                JSSVGPODTypeWrapperCreatorForList<PODType>::create(item.get(), attributeName).get(), context);
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue finishSetterReadOnlyResult(JSC::ExecState* exec, ExceptionCode& ec, JSPODListType* wrapper,                                
+                                               PassRefPtr<typename JSSVGPODListTraits<PODType>::PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    JSSVGContextCache::propagateSVGDOMChange(wrapper, listImp->associatedAttributeName());
+    return toJS(exec, wrapper->globalObject(),
+                JSSVGStaticPODTypeWrapper<PODType>::create(*item).get(), 0  /* no context on purpose */);
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue clear(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList&,
+                          typename JSSVGPODListTraits<PODType>::ConversionCallback)
+{
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    listImp->clear(ec);
+
+    if (ec)
+        setDOMException(exec, ec);
+    else
+        JSSVGContextCache::propagateSVGDOMChange(wrapper, listImp->associatedAttributeName());
+
+    return JSC::jsUndefined();
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue initialize(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                               typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->initialize(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue getItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                            typename JSSVGPODListTraits<PODType>::ConversionCallback)
+{
+    bool indexOk = false;
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishGetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->getItem(index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue insertItemBefore(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                                     typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    bool indexOk = false;
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->insertItemBefore(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue replaceItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                                typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    bool indexOk = false;
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->replaceItem(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue removeItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                               typename JSSVGPODListTraits<PODType>::ConversionCallback)
+{
+    bool indexOk = false;
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetterReadOnlyResult<JSPODListType, PODType>(exec, ec, wrapper,
+                                                              listImp->removeItem(index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue appendItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                               typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->appendItem(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), ec));
+}
+
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
index 51e4e9e..2efc60e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
@@ -28,28 +28,31 @@
 #define JSSVGPODTypeWrapper_h
 
 #if ENABLE(SVG)
+#include "JSSVGContextCache.h"
 #include "SVGElement.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
+class DOMObject;
+
 template<typename PODType>
 class JSSVGPODTypeWrapper : public RefCounted<JSSVGPODTypeWrapper<PODType> > {
 public:
     virtual ~JSSVGPODTypeWrapper() { }
 
     virtual operator PODType() = 0;
-    virtual void commitChange(PODType, SVGElement*) = 0;
+    virtual void commitChange(PODType, DOMObject*) = 0;
 };
 
 // This file contains JS wrapper objects for SVG datatypes, that are passed around by value
-// in WebCore/svg (aka. 'POD types'). For instance SVGMatrix is mapped to TransformationMatrix, and
+// in WebCore/svg (aka. 'POD types'). For instance SVGMatrix is mapped to AffineTransform, and
 // passed around as const reference. SVG DOM demands these objects to be "live", changes to any
 // of the writable attributes of SVGMatrix need to be reflected in the object which exposed the
-// SVGMatrix object (ie. 'someElement.transform.matrix.a = 50.0', in that case 'SVGTransform').
-// The SVGTransform class stores its "TransformationMatrix m_matrix" object on the stack. If it would
+// SVGMatrix object (i.e. 'someElement.transform.matrix.a = 50.0', in that case 'SVGTransform').
+// The SVGTransform class stores its "AffineTransform m_matrix" object on the stack. If it would
 // be stored as pointer we could just build an auto-generated JSSVG* wrapper object around it
-// and all changes to that object would automatically affect the TransformationMatrix* object stored
+// and all changes to that object would automatically affect the AffineTransform* object stored
 // in the SVGTransform object. For the sake of efficiency and memory we don't pass around any
 // primitive values as pointers, so a custom JS wrapper object is needed for all SVG types, that
 // are internally represented by POD types (SVGRect <-> FloatRect, SVGPoint <-> FloatPoint, ...).
@@ -68,13 +71,13 @@ public:
 // GetterMethod and SetterMethod are each 12 bytes. We have to pack to a size
 // greater than or equal to that to avoid an alignment warning (C4121). 16 is
 // the next-largest size allowed for packing, so we use that.
-#pragma pack(16)
+#pragma pack(push, 16)
 #endif
 template<typename PODType, typename PODTypeCreator>
 class JSSVGDynamicPODTypeWrapper : public JSSVGPODTypeWrapper<PODType> {
 public:
     typedef PODType (PODTypeCreator::*GetterMethod)() const; 
-    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+    typedef void (PODTypeCreator::*SetterMethod)(const PODType&);
 
     static PassRefPtr<JSSVGDynamicPODTypeWrapper> create(PassRefPtr<PODTypeCreator> creator, GetterMethod getter, SetterMethod setter)
     {
@@ -86,12 +89,10 @@ public:
         return (m_creator.get()->*m_getter)();
     }
 
-    virtual void commitChange(PODType type, SVGElement* context)
+    virtual void commitChange(PODType type, DOMObject* wrapper)
     {
         (m_creator.get()->*m_setter)(type);
-
-        if (context)
-            context->svgAttributeChanged(m_creator->associatedAttributeName());
+        JSSVGContextCache::propagateSVGDOMChange(wrapper, m_creator->associatedAttributeName());
     }
 
 private:
@@ -105,15 +106,20 @@ private:
         ASSERT(m_setter);
     }
 
+    virtual ~JSSVGDynamicPODTypeWrapper();
+
     // Update callbacks
     RefPtr<PODTypeCreator> m_creator;
     GetterMethod m_getter;
     SetterMethod m_setter;
 };
+#if COMPILER(MSVC)
+#pragma pack(pop)
+#endif
 
-// Represents a JS wrapper object for SVG POD types (not for SVGAnimated* clases). Any modification to the SVG POD
+// Represents a JS wrapper object for SVG POD types (not for SVGAnimated* classes). Any modification to the SVG POD
 // types don't cause any updates unlike JSSVGDynamicPODTypeWrapper. This class is used for return values (ie. getBBox())
-// and for properties where SVG specification explicitely states, that the contents of the POD type are immutable.
+// and for properties where SVG specification explicitly states, that the contents of the POD type are immutable.
 
 template<typename PODType>
 class JSSVGStaticPODTypeWrapper : public JSSVGPODTypeWrapper<PODType> {
@@ -128,7 +134,7 @@ public:
         return m_podType;
     }
 
-    virtual void commitChange(PODType type, SVGElement*)
+    virtual void commitChange(PODType type, DOMObject*)
     {
         m_podType = type;
     }
@@ -152,10 +158,10 @@ public:
         return adoptRef(new JSSVGStaticPODTypeWrapperWithPODTypeParent(type, parent));
     }
 
-    virtual void commitChange(PODType type, SVGElement* context)
+    virtual void commitChange(PODType type, DOMObject* wrapper)
     {
-        JSSVGStaticPODTypeWrapper<PODType>::commitChange(type, context);
-        m_parentType->commitChange(ParentTypeArg(type), context);    
+        JSSVGStaticPODTypeWrapper<PODType>::commitChange(type, wrapper);
+        m_parentType->commitChange(ParentTypeArg(type), wrapper);
     }
 
 private:
@@ -172,7 +178,7 @@ private:
 // GetterMethod and SetterMethod are each 12 bytes. We have to pack to a size
 // greater than or equal to that to avoid an alignment warning (C4121). 16 is
 // the next-largest size allowed for packing, so we use that.
-#pragma pack(16)
+#pragma pack(push, 16)
 #endif
 template<typename PODType, typename ParentType>
 class JSSVGStaticPODTypeWrapperWithParent : public JSSVGPODTypeWrapper<PODType> {
@@ -190,7 +196,7 @@ public:
         return (m_parent.get()->*m_getter)();
     }
 
-    virtual void commitChange(PODType type, SVGElement*)
+    virtual void commitChange(PODType type, DOMObject*)
     {
         (m_parent.get()->*m_setter)(type);
     }
@@ -223,7 +229,7 @@ public:
     typedef SVGPODListItem<PODType> PODListItemPtrType;
 
     typedef PODType (SVGPODListItem<PODType>::*GetterMethod)() const; 
-    typedef void (SVGPODListItem<PODType>::*SetterMethod)(PODType);
+    typedef void (SVGPODListItem<PODType>::*SetterMethod)(const PODType&);
 
     static PassRefPtr<JSSVGPODTypeWrapperCreatorForList> create(PassRefPtr<PODListItemPtrType> creator, const QualifiedName& attributeName)
     {
@@ -235,15 +241,13 @@ public:
         return (m_creator.get()->*m_getter)();
     }
 
-    virtual void commitChange(PODType type, SVGElement* context)
+    virtual void commitChange(PODType type, DOMObject* wrapper)
     {
         if (!m_setter)
             return;
 
         (m_creator.get()->*m_setter)(type);
-
-        if (context)
-            context->svgAttributeChanged(m_associatedAttributeName);
+        JSSVGContextCache::propagateSVGDOMChange(wrapper, m_associatedAttributeName);
     }
 
 private:
@@ -269,7 +273,7 @@ private:
 template<typename PODType, typename PODTypeCreator>
 struct PODTypeWrapperCacheInfo {
     typedef PODType (PODTypeCreator::*GetterMethod)() const; 
-    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+    typedef void (PODTypeCreator::*SetterMethod)(const PODType&);
 
     // Empty value
     PODTypeWrapperCacheInfo()
@@ -309,6 +313,9 @@ struct PODTypeWrapperCacheInfo {
     GetterMethod getter;
     SetterMethod setter;
 };
+#if COMPILER(MSVC)
+#pragma pack(pop)
+#endif
 
 template<typename PODType, typename PODTypeCreator>
 struct PODTypeWrapperCacheInfoHash {
@@ -351,60 +358,53 @@ struct PODTypeWrapperCacheInfoTraits : WTF::GenericHashTraits<PODTypeWrapperCach
     }
 };
 
+// Used for dynamic read-write attributes
 template<typename PODType, typename PODTypeCreator>
 class JSSVGDynamicPODTypeWrapperCache {
 public:
     typedef PODType (PODTypeCreator::*GetterMethod)() const; 
-    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+    typedef void (PODTypeCreator::*SetterMethod)(const PODType&);
 
     typedef PODTypeWrapperCacheInfo<PODType, PODTypeCreator> CacheInfo;
     typedef PODTypeWrapperCacheInfoHash<PODType, PODTypeCreator> CacheInfoHash;
     typedef PODTypeWrapperCacheInfoTraits<PODType, PODTypeCreator> CacheInfoTraits;
 
     typedef JSSVGPODTypeWrapper<PODType> WrapperBase;
-    typedef JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator> DynamicWrapper;
-    typedef HashMap<CacheInfo, DynamicWrapper*, CacheInfoHash, CacheInfoTraits> DynamicWrapperHashMap;
-    typedef typename DynamicWrapperHashMap::const_iterator DynamicWrapperHashMapIterator;
+    typedef JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator> Wrapper;
+    typedef HashMap<CacheInfo, Wrapper*, CacheInfoHash, CacheInfoTraits> WrapperMap;
 
-    static DynamicWrapperHashMap& dynamicWrapperHashMap()
+    static WrapperMap& wrapperMap()
     {
-        DEFINE_STATIC_LOCAL(DynamicWrapperHashMap, s_dynamicWrapperHashMap, ());
-        return s_dynamicWrapperHashMap;
+        DEFINE_STATIC_LOCAL(WrapperMap, s_wrapperMap, ());
+        return s_wrapperMap;
     }
 
-    // Used for readwrite attributes only
     static PassRefPtr<WrapperBase> lookupOrCreateWrapper(PODTypeCreator* creator, GetterMethod getter, SetterMethod setter)
     {
-        DynamicWrapperHashMap& map(dynamicWrapperHashMap());
         CacheInfo info(creator, getter, setter);
+        pair<typename WrapperMap::iterator, bool> result = wrapperMap().add(info, 0);
+        if (!result.second) // pre-existing entry
+            return result.first->second;
 
-        if (map.contains(info))
-            return map.get(info);
-
-        RefPtr<DynamicWrapper> wrapper = DynamicWrapper::create(creator, getter, setter);
-        map.set(info, wrapper.get());
+        RefPtr<Wrapper> wrapper = Wrapper::create(creator, getter, setter);
+        result.first->second = wrapper.get();
         return wrapper.release();
     }
 
-    static void forgetWrapper(WrapperBase* wrapper)
+    static void forgetWrapper(PODTypeCreator* creator, GetterMethod getter, SetterMethod setter)
     {
-        DynamicWrapperHashMap& map(dynamicWrapperHashMap());
-
-        DynamicWrapperHashMapIterator it = map.begin();
-        DynamicWrapperHashMapIterator end = map.end();
-
-        for (; it != end; ++it) {
-            if (it->second != wrapper)
-                continue;
-
-            // It's guaranteed that there's just one object we need to take care of.
-            map.remove(it->first);
-            break;
-        }
+        CacheInfo info(creator, getter, setter);
+        wrapperMap().remove(info);
     }
 };
 
-};
+template<typename PODType, typename PODTypeCreator>
+JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator>::~JSSVGDynamicPODTypeWrapper()
+{
+    JSSVGDynamicPODTypeWrapperCache<PODType, PODTypeCreator>::forgetWrapper(m_creator.get(), m_getter, m_setter);
+}
+
+} // namespace WebCore
 
 #endif // ENABLE(SVG)
 #endif // JSSVGPODTypeWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index 42fa878..eac2c4b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -21,6 +21,8 @@
 
 #if ENABLE(SVG)
 #include "JSSVGPathSeg.h"
+
+#include "JSDOMBinding.h"
 #include "JSSVGPathSegArcAbs.h"
 #include "JSSVGPathSegArcRel.h"
 #include "JSSVGPathSegClosePath.h"
@@ -40,9 +42,6 @@
 #include "JSSVGPathSegLinetoVerticalRel.h"
 #include "JSSVGPathSegMovetoAbs.h"
 #include "JSSVGPathSegMovetoRel.h"
-
-#include "JSDOMBinding.h"
-
 #include "SVGPathSeg.h"
 #include "SVGPathSegArc.h"
 #include "SVGPathSegClosePath.h"
@@ -64,8 +63,10 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, SVGPathSeg* objec
     if (!object)
         return jsNull();
 
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object)) {
+        ASSERT(JSSVGContextCache::svgContextForDOMObject(wrapper) == context);
         return wrapper;
+    }
 
     switch (object->pathSegType()) {
     case SVGPathSeg::PATHSEG_CLOSEPATH:
@@ -115,5 +116,3 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, SVGPathSeg* objec
 }
 
 #endif // ENABLE(SVG)
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
index b71f3a6..4831727 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
@@ -24,6 +24,7 @@
 
 #include "Document.h"
 #include "Frame.h"
+#include "JSSVGContextCache.h"
 #include "JSSVGPathSeg.h"
 #include "SVGDocumentExtensions.h"
 #include "SVGElement.h"
@@ -39,12 +40,12 @@ JSValue JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
-    imp->clear(ec);
+    SVGPathSegList* list = impl();
+    list->clear(ec);
 
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return jsUndefined();
 }
 
@@ -53,14 +54,15 @@ JSValue JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
 
-    SVGPathSeg* obj = WTF::getPtr(imp->initialize(newItem, ec));
+    SVGPathSeg* obj = WTF::getPtr(list->initialize(newItem, ec));
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), obj, m_context.get());
+    JSValue result = toJS(exec, globalObject(), obj, context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -75,10 +77,11 @@ JSValue JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
-    SVGPathSeg* obj = WTF::getPtr(imp->getItem(index, ec));
+    SVGPathSegList* list = impl();
+    SVGPathSeg* obj = WTF::getPtr(list->getItem(index, ec));
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), obj, m_context.get());
+    JSValue result = toJS(exec, globalObject(), obj, context);
     setDOMException(exec, ec);
     return result;
 }
@@ -95,12 +98,13 @@ JSValue JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(list->insertItemBefore(newItem, index, ec)), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -116,12 +120,13 @@ JSValue JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(list->replaceItem(newItem, index, ec)), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -136,14 +141,15 @@ JSValue JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
 
-    RefPtr<SVGPathSeg> obj(imp->removeItem(index, ec));
+    RefPtr<SVGPathSeg> obj(list->removeItem(index, ec));
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), obj.get(), m_context.get());
+    JSValue result = toJS(exec, globalObject(), obj.get(), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -152,12 +158,13 @@ JSValue JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(list->appendItem(newItem, ec)), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
deleted file mode 100644
index 1969fe2..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "JSSVGPointList.h"
-
-#include "JSSVGPoint.h"
-#include "SVGPointList.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-typedef SVGPODListItem<FloatPoint> PODListItem;
-typedef SVGList<RefPtr<PODListItem> > SVGPointListBase;
-
-static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), list->associatedAttributeName()).get(), context);
-}
-
-static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    const QualifiedName& attributeName = list->associatedAttributeName();
-    context->svgAttributeChanged(attributeName);
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), attributeName).get(), context);
-}
-
-static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    context->svgAttributeChanged(list->associatedAttributeName());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<FloatPoint>::create(*item).get(), context);
-}
-
-JSValue JSSVGPointList::clear(ExecState* exec, const ArgList&)
-{
-    ExceptionCode ec = 0;
-    impl()->clear(ec);
-    setDOMException(exec, ec);
-    m_context->svgAttributeChanged(impl()->associatedAttributeName());
-    return jsUndefined();
-}
-
-JSValue JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(0))), ec));
-}
-
-JSValue JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishGetter(exec, ec, context(), impl(),
-        listImp->getItem(index, ec));
-}
-
-JSValue JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
-}
-
-JSValue JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
-}
-
-JSValue JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetterReadOnlyResult(exec, ec, context(), impl(),
-        listImp->removeItem(index, ec));
-}
-
-JSValue JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(0))), ec));
-}
-
-}
-
-#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
deleted file mode 100644
index 1a9110a..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "JSSVGTransformList.h"
-
-#include "JSSVGTransform.h"
-#include "SVGTransformList.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-typedef SVGPODListItem<SVGTransform> PODListItem;
-typedef SVGList<RefPtr<PODListItem> > SVGTransformListBase;
-
-static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), list->associatedAttributeName()).get(), context);
-}
-
-static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    const QualifiedName& attributeName = list->associatedAttributeName();
-    context->svgAttributeChanged(attributeName);
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), attributeName).get(), context);
-}
-
-static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    context->svgAttributeChanged(list->associatedAttributeName());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGTransform>::create(*item).get(), context);
-}
-
-JSValue JSSVGTransformList::clear(ExecState* exec, const ArgList&)
-{
-    ExceptionCode ec = 0;
-    impl()->clear(ec);
-    setDOMException(exec, ec);
-    m_context->svgAttributeChanged(impl()->associatedAttributeName());
-    return jsUndefined();
-}
-
-JSValue JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(0))), ec));
-}
-
-JSValue JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishGetter(exec, ec, context(), impl(),
-        listImp->getItem(index, ec));
-}
-
-JSValue JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
-}
-
-JSValue JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
-}
-
-JSValue JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetterReadOnlyResult(exec, ec, context(), impl(),
-        listImp->removeItem(index, ec));
-}
-
-JSValue JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(0))), ec));
-}
-
-}
-
-#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
index e416d35..63a38d6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
@@ -41,9 +41,9 @@ bool JSStorage::canGetItemsForName(ExecState*, Storage* impl, const Identifier&
     return impl->contains(propertyName);
 }
 
-JSValue JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStorage::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSStorage* thisObj = static_cast<JSStorage*>(asObject(slot.slotBase()));
+    JSStorage* thisObj = static_cast<JSStorage*>(asObject(slotBase));
     return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
 }
 
@@ -64,13 +64,13 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return true;
 }
 
-void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier(exec, m_impl->key(i)));
         
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
index d711b6f..ecfc6a6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -40,7 +40,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, StyleSheet* style
     if (!styleSheet)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), styleSheet);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, styleSheet);
     if (wrapper)
         return wrapper;
 
@@ -68,10 +68,8 @@ void JSStyleSheet::markChildren(MarkStack& markStack)
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = sheet->ownerNode()) {
-        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
-            markStack.append(ownerNodeWrapper);
-    }
+    if (Node* ownerNode = sheet->ownerNode())
+        markDOMNodeWrapper(markStack, ownerNode->document(), ownerNode);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index 7bf9389..873f211 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -52,9 +52,9 @@ bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheet
     return styleSheetList->getNamedItem(propertyName);
 }
 
-JSValue JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStyleSheetList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
+    JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slotBase));
     HTMLStyleElement* element = thisObj->impl()->getNamedItem(propertyName);
     ASSERT(element);
     return toJS(exec, element->sheet());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
index 93d53ca..8671908 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
@@ -27,28 +27,27 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasArrayBufferConstructor.h"
+#include "JSWebGLArrayBufferConstructor.h"
 
 #include "Document.h"
-#include "CanvasArrayBuffer.h"
-#include "JSCanvasArrayBuffer.h"
+#include "JSWebGLArrayBuffer.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
+const ClassInfo JSWebGLArrayBufferConstructor::s_info = { "WebGLArrayBufferConstructor", 0, 0, 0 };
 
-JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLArrayBufferConstructor::JSWebGLArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLArrayBufferPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
+    JSWebGLArrayBufferConstructor* jsConstructor = static_cast<JSWebGLArrayBufferConstructor*>(constructor);
 
     unsigned int size = 0;
     if (args.size() == 1) {
@@ -56,10 +55,15 @@ static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* construct
         if (isnan(size))
             size = 0;
     }
-    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(size, 1);
+    if (!buffer.get()){
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), buffer.get()));
 }
 
-JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasArrayBuffer;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
index 5f1254e..c7a927e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
@@ -23,26 +23,27 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasArrayBufferConstructor_h
-#define JSCanvasArrayBufferConstructor_h
+#ifndef JSWebGLArrayBufferConstructor_h
+#define JSWebGLArrayBufferConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
-#include "JSCanvasArrayBuffer.h"
+#include "JSWebGLArrayBuffer.h"
 #include <runtime/Error.h>
+#include "WebGLArrayBuffer.h"
 
 namespace WebCore {
 
-    class CanvasArray;
+    class WebGLArray;
 
     // Template function used by CanvasXXXArrayConstructors
     template<class C, typename T>
-    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    PassRefPtr<WebGLArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
     {
         // There are 3 constructors:
         //
         //  1) (in int size)
-        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  2) (in WebGLArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
         //  3) (in sequence<T>) - This ends up being a JS "array-like" object
         //
         RefPtr<C> arrayObject;
@@ -51,24 +52,30 @@ namespace WebCore {
         if (args.size() < 1)
             return C::create(0, 0, 0);
         
+        if (args.size() > 1 && !args.at(0).isObject())
+            // Invalid first argument
+            return 0;
+
         if (args.at(0).isObject()) {
-            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
+            RefPtr<WebGLArrayBuffer> buffer = toWebGLArrayBuffer(args.at(0));
             if (buffer) {
-                int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
-                unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
+                unsigned offset = (args.size() > 1) ? args.at(1).toUInt32(exec) : 0;
+                unsigned int length = (buffer->byteLength() - offset) / sizeof(T);
+                if (args.size() > 2)
+                    length = args.at(2).toUInt32(exec);
                 return C::create(buffer, offset, length);
             }
             
             JSC::JSObject* array = asObject(args.at(0));
-            int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+            unsigned length = array->get(exec, JSC::Identifier(exec, "length")).toUInt32(exec);
             void* tempValues;
-            if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues)) {
+            if (!tryFastCalloc(length, sizeof(T)).getValue(tempValues)) {
                 throwError(exec, JSC::GeneralError);
                 return 0;
             }
             
             OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
-            for (int i = 0; i < length; ++i) {
+            for (unsigned i = 0; i < length; ++i) {
                 JSC::JSValue v = array->get(exec, i);
                 if (exec->hadException())
                     return 0;
@@ -78,13 +85,13 @@ namespace WebCore {
             return C::create(values.get(), length);
         }
         
-        unsigned size = static_cast<unsigned>(args.at(0).toInt32(exec));
+        unsigned size = args.at(0).toUInt32(exec);
         return C::create(size);
     }
 
-    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
+    class JSWebGLArrayBufferConstructor : public DOMConstructorObject {
     public:
-        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -94,4 +101,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasArrayBufferConstructor_h
+#endif // JSWebGLArrayBufferConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayCustom.cpp
new file mode 100644
index 0000000..d111d4e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayCustom.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLByteArray.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebGLShortArray.h"
+#include "JSWebGLUnsignedShortArray.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLUnsignedIntArray.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    if (object) {
+        if (object->isFloatArray())
+            return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, static_cast<WebGLFloatArray*>(object));
+        if (object->isUnsignedByteArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, static_cast<WebGLUnsignedByteArray*>(object));
+        if (object->isByteArray())
+            return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, static_cast<WebGLByteArray*>(object));
+        if (object->isIntArray())
+            return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, static_cast<WebGLIntArray*>(object));
+        if (object->isUnsignedIntArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, static_cast<WebGLUnsignedIntArray*>(object));
+        if (object->isShortArray())
+            return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, static_cast<WebGLShortArray*>(object));
+        if (object->isUnsignedShortArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, static_cast<WebGLUnsignedShortArray*>(object));
+    }
+    return jsUndefined();
+}
+
+JSValue JSWebGLArray::slice(ExecState* exec, const ArgList& args)
+{
+    WebGLArray* array = reinterpret_cast<WebGLArray*>(impl());
+
+    int start, end;
+    switch (args.size()) {
+    case 0:
+        start = 0;
+        end = array->length();
+        break;
+    case 1:
+        start = args.at(0).toInt32(exec);
+        end = array->length();
+        break;
+    default:
+        start = args.at(0).toInt32(exec);
+        end = args.at(1).toInt32(exec);
+    }
+    return toJS(exec, globalObject(), array->slice(start, end));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayHelper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayHelper.h
new file mode 100644
index 0000000..481c68f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayHelper.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLArrayHelper_h
+#define JSWebGLArrayHelper_h
+
+#include "ExceptionCode.h"
+#include "JSDOMBinding.h"
+#include <interpreter/CallFrame.h>
+#include <runtime/ArgList.h>
+#include <runtime/Error.h>
+#include <runtime/JSObject.h>
+#include <runtime/JSValue.h>
+
+namespace WebCore {
+
+template <class T>
+JSC::JSValue setWebGLArrayFromArray(JSC::ExecState* exec, T* webGLArray, JSC::ArgList const& args)
+{
+    if (args.at(0).isObject()) {
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        JSC::JSObject* array = JSC::asObject(args.at(0));
+        uint32_t offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        uint32_t length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+        if (offset > webGLArray->length() ||
+            offset + length > webGLArray->length() ||
+            offset + length < offset)
+            setDOMException(exec, INDEX_SIZE_ERR);
+        else {
+            for (uint32_t i = 0; i < length; i++) {
+                JSC::JSValue v = array->get(exec, i);
+                if (exec->hadException())
+                    return JSC::jsUndefined();
+                webGLArray->set(i + offset, v.toNumber(exec));
+            }
+        }
+
+        return JSC::jsUndefined();
+    }
+
+    return JSC::throwError(exec, JSC::SyntaxError);
+}
+
+}
+
+#endif // JSWebGLArrayHelper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
index 15e39c2..f76fb1d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
@@ -27,38 +27,42 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasFloatArrayConstructor.h"
+#include "JSWebGLByteArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasFloatArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasFloatArray.h"
+#include "WebGLByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLByteArrayConstructor::s_info = { "WebGLByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLByteArrayConstructor::JSWebGLByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLByteArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
-    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
+    JSWebGLByteArrayConstructor* jsConstructor = static_cast<JSWebGLByteArrayConstructor*>(constructor);
+    RefPtr<WebGLByteArray> array = static_cast<WebGLByteArray*>(construct<WebGLByteArray, signed char>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasFloatArray;
+    constructData.native.function = constructCanvasByteArray;
     return ConstructTypeHost;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
index 5e19652..a201567 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasIntArrayConstructor_h
-#define JSCanvasIntArrayConstructor_h
+#ifndef JSWebGLByteArrayConstructor_h
+#define JSWebGLByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
+    class JSWebGLByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasIntArrayConstructor_h
+#endif // JSWebGLByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
new file mode 100644
index 0000000..f7872a8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLByteArray.h"
+
+#include "WebGLByteArray.h"
+
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLByteArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() < 1 || args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLByteArray* array = toWebGLByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
index ec1d66d..e6375ac 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
@@ -27,38 +27,42 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasByteArrayConstructor.h"
+#include "JSWebGLFloatArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArray.h"
+#include "WebGLFloatArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLFloatArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLFloatArrayConstructor::s_info = { "WebGLFloatArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLFloatArrayConstructor::JSWebGLFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLFloatArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
-    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
+    JSWebGLFloatArrayConstructor* jsConstructor = static_cast<JSWebGLFloatArrayConstructor*>(constructor);
+    RefPtr<WebGLFloatArray> array = static_cast<WebGLFloatArray*>(construct<WebGLFloatArray, float>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasByteArray;
+    constructData.native.function = constructCanvasFloatArray;
     return ConstructTypeHost;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
index 4d5dc11..faf90ff 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasByteArrayConstructor_h
-#define JSCanvasByteArrayConstructor_h
+#ifndef JSWebGLFloatArrayConstructor_h
+#define JSWebGLFloatArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
+    class JSWebGLFloatArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasByteArrayConstructor_h
+#endif // JSWebGLFloatArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
new file mode 100644
index 0000000..f4acbcf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toNumber(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLFloatArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLFloatArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in float value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<float>(args.at(1).toNumber(exec)));
+        return jsUndefined();
+    }
+
+    WebGLFloatArray* array = toWebGLFloatArray(args.at(0));
+    if (array) {
+        // void set(in WebGLFloatArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
index 6d57912..5b14803 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
@@ -27,36 +27,40 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasIntArrayConstructor.h"
+#include "JSWebGLIntArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasIntArray.h"
+#include "WebGLIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLIntArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLIntArrayConstructor::s_info = { "WebGLIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLIntArrayConstructor::JSWebGLIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLIntArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
-    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
+    JSWebGLIntArrayConstructor* jsConstructor = static_cast<JSWebGLIntArrayConstructor*>(constructor);
+    RefPtr<WebGLIntArray> array = static_cast<WebGLIntArray*>(construct<WebGLIntArray, int>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasIntArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
index efea250..d42c046 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasFloatArrayConstructor_h
-#define JSCanvasFloatArrayConstructor_h
+#ifndef JSWebGLIntArrayConstructor_h
+#define JSWebGLIntArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
+    class JSWebGLIntArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasFloatArrayConstructor_h
+#endif // JSWebGLIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
new file mode 100644
index 0000000..de08256
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLIntArray.h"
+
+#include "WebGLIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLIntArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed int>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLIntArray* array = toWebGLIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
new file mode 100644
index 0000000..e336027
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -0,0 +1,835 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLRenderingContext.h"
+
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "HTMLVideoElement.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSHTMLVideoElement.h"
+#include "JSImageData.h"
+#include "JSWebGLBuffer.h"
+#include "JSWebGLFloatArray.h"
+#include "JSWebGLFramebuffer.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLProgram.h"
+#include "JSWebGLRenderbuffer.h"
+#include "JSWebGLShader.h"
+#include "JSWebGLTexture.h"
+#include "JSWebGLUniformLocation.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebKitCSSMatrix.h"
+#include "NotImplemented.h"
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLGetInfo.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderingContext.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSWebGLRenderingContext::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+    ExceptionCode ec = 0;
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, count, usage, ec);
+    } else {
+        WebGLArray* array = toWebGLArray(args.at(1));
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, array, usage, ec);
+    }
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSWebGLRenderingContext::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    ExceptionCode ec = 0;
+    
+    WebGLArray* array = toWebGLArray(args.at(2));
+    
+    static_cast<WebGLRenderingContext*>(impl())->bufferSubData(target, offset, array, ec);
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, const WebGLGetInfo& info)
+{
+    switch (info.getType()) {
+    case WebGLGetInfo::kTypeBool:
+        return jsBoolean(info.getBool());
+    case WebGLGetInfo::kTypeFloat:
+        return jsNumber(exec, info.getFloat());
+    case WebGLGetInfo::kTypeLong:
+        return jsNumber(exec, info.getLong());
+    case WebGLGetInfo::kTypeNull:
+        return jsNull();
+    case WebGLGetInfo::kTypeString:
+        return jsString(exec, info.getString());
+    case WebGLGetInfo::kTypeUnsignedLong:
+        return jsNumber(exec, info.getUnsignedLong());
+    case WebGLGetInfo::kTypeWebGLBuffer:
+        return toJS(exec, globalObject, info.getWebGLBuffer());
+    case WebGLGetInfo::kTypeWebGLFloatArray:
+        return toJS(exec, globalObject, info.getWebGLFloatArray());
+    case WebGLGetInfo::kTypeWebGLFramebuffer:
+        return toJS(exec, globalObject, info.getWebGLFramebuffer());
+    case WebGLGetInfo::kTypeWebGLIntArray:
+        return toJS(exec, globalObject, info.getWebGLIntArray());
+    // FIXME: implement WebGLObjectArray
+    // case WebGLGetInfo::kTypeWebGLObjectArray:
+    case WebGLGetInfo::kTypeWebGLProgram:
+        return toJS(exec, globalObject, info.getWebGLProgram());
+    case WebGLGetInfo::kTypeWebGLRenderbuffer:
+        return toJS(exec, globalObject, info.getWebGLRenderbuffer());
+    case WebGLGetInfo::kTypeWebGLTexture:
+        return toJS(exec, globalObject, info.getWebGLTexture());
+    case WebGLGetInfo::kTypeWebGLUnsignedByteArray:
+        return toJS(exec, globalObject, info.getWebGLUnsignedByteArray());
+    default:
+        notImplemented();
+        return jsUndefined();
+    }
+}
+
+enum ObjectType {
+    kBuffer, kRenderbuffer, kTexture, kVertexAttrib
+};
+
+static JSValue getObjectParameter(JSWebGLRenderingContext* obj, ExecState* exec, const ArgList& args, ObjectType objectType)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(obj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info;
+    switch (objectType) {
+    case kBuffer:
+        info = context->getBufferParameter(target, pname, ec);
+        break;
+    case kRenderbuffer:
+        info = context->getRenderbufferParameter(target, pname, ec);
+        break;
+    case kTexture:
+        info = context->getTexParameter(target, pname, ec);
+        break;
+    case kVertexAttrib:
+        // target => index
+        info = context->getVertexAttrib(target, pname, ec);
+        break;
+    default:
+        notImplemented();
+        break;
+    }
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, obj->globalObject(), info);
+}
+
+enum WhichProgramCall {
+    kProgramParameter, kUniform
+};
+
+JSValue JSWebGLRenderingContext::getBufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kBuffer);
+}
+
+JSValue JSWebGLRenderingContext::getFramebufferAttachmentParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned attachment = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(2).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getFramebufferAttachmentParameter(target, attachment, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 1)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned pname = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getParameter(pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getProgramParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getProgramParameter(program, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getRenderbufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kRenderbuffer);
+}
+
+JSValue JSWebGLRenderingContext::getShaderParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLShader* shader = toWebGLShader(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getShaderParameter(shader, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getTexParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kTexture);
+}
+
+JSValue JSWebGLRenderingContext::getUniform(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    WebGLUniformLocation* loc = toWebGLUniformLocation(args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getUniform(program, loc, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getVertexAttrib(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kVertexAttrib);
+}
+
+//   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, in GLint border, in GLenum format, in GLenum type, in WebGLArray pixels);
+//   void texImage2D(in GLenum target, in GLint level, in ImageData pixels, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image, [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texImage2D(in GLenum target, in GLint level, in HTMLCanvasElement canvas, [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texImage2D(in GLenum target, in GLint level, in HTMLVideoElement video, [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+JSValue JSWebGLRenderingContext::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+
+    JSObject* o = 0;
+    
+    if (args.size() <= 5) {
+        // This is one of the last 4 forms. Param 2 can be ImageData or <img>, <canvas> or <video> element.
+        JSValue value = args.at(2);
+    
+        if (!value.isObject())
+            return throwError(exec, TypeError);
+        
+        o = asObject(value);
+        
+        bool flipY = args.at(3).toBoolean(exec);
+        bool premultiplyAlpha = args.at(4).toBoolean(exec);
+        
+        if (o->inherits(&JSImageData::s_info)) {
+            ImageData* data = static_cast<ImageData*>(static_cast<JSImageData*>(o)->impl());
+            context->texImage2D(target, level, data, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLImageElement::s_info)) {
+            HTMLImageElement* element = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(o)->impl());
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+            HTMLCanvasElement* element = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(o)->impl());
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLVideoElement::s_info)) {
+            HTMLVideoElement* element = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(o)->impl());
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else
+            ec = TYPE_MISMATCH_ERR;
+    } else {
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+
+        // This must be the WebGLArray case
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        JSValue value = args.at(8);
+            
+        // For this case passing 0 (for a null array) is allowed
+        if (value.isNull())
+            context->texImage2D(target, level, internalformat, width, height, border, format, type, 0, ec);
+        else if (value.isObject()) {
+            o = asObject(value);
+            
+            if (o->inherits(&JSWebGLArray::s_info)) {
+                // FIXME: Need to check to make sure WebGLArray is a WebGLByteArray or WebGLShortArray,
+                // depending on the passed type parameter.
+                WebGLArray* obj = static_cast<WebGLArray*>(static_cast<JSWebGLArray*>(o)->impl());
+                context->texImage2D(target, level, internalformat, width, height, border, format, type, obj, ec);
+            } else
+                return throwError(exec, TypeError);
+        } else 
+            return throwError(exec, TypeError);
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();    
+}
+
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in GLsizei width, in GLsizei height, in GLenum format, in GLenum type, in WebGLArray pixels);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in ImageData pixels, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in HTMLImageElement image, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in HTMLCanvasElement canvas, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in HTMLVideoElement video, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+JSValue JSWebGLRenderingContext::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 5 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    unsigned xoff = args.at(2).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    unsigned yoff = args.at(3).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    JSObject* o = 0;
+        
+    if (args.size() <= 7) {
+        // This is one of the last 4 forms. Param 4 can be <img>, <canvas> or <video> element, of the format param.
+        JSValue value = args.at(4);
+
+        if (!value.isObject())
+            return throwError(exec, SyntaxError);
+
+        o = asObject(value);
+
+        bool flipY = args.at(5).toBoolean(exec);
+        bool premultiplyAlpha = args.at(6).toBoolean(exec);
+        
+        if (o->inherits(&JSImageData::s_info)) {
+            ImageData* data = static_cast<ImageData*>(static_cast<JSImageData*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, data, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLImageElement::s_info)) {
+            HTMLImageElement* element = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+            HTMLCanvasElement* element = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLVideoElement::s_info)) {
+            HTMLVideoElement* element = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, element, flipY, premultiplyAlpha, ec);
+        } else
+            ec = TYPE_MISMATCH_ERR;
+    } else {
+        // This must be the WebGLArray form
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+
+        unsigned width = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        unsigned height = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        JSValue value = args.at(8);
+        if (!value.isObject())
+            context->texSubImage2D(target, level, xoff, yoff, width, height, format, type, 0, ec);
+        else {
+            o = asObject(value);
+        
+            if (o->inherits(&JSWebGLArray::s_info)) {
+                WebGLArray* obj = static_cast<WebGLArray*>(static_cast<JSWebGLArray*>(o)->impl());
+                context->texSubImage2D(target, level, xoff, yoff, width, height, format, type, obj, ec);
+            } else
+                return throwError(exec, TypeError);
+        }
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+template<typename T, size_t inlineCapacity>
+bool toVector(JSC::ExecState* exec, JSC::JSValue value, Vector<T, inlineCapacity>& vector)
+{
+    if (!value.isObject())
+        return false;
+
+    JSC::JSObject* object = asObject(value);
+    int32_t length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    vector.resize(length);
+
+    for (int32_t i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return false;
+        vector[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    return true;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static bool functionForUniform(DataFunctionToCall f)
+{
+    switch (f) {
+    case f_uniform1v:
+    case f_uniform2v:
+    case f_uniform3v:
+    case f_uniform4v:
+        return true;
+        break;
+    default: break;
+    }
+    return false;
+}
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+    
+    WebGLUniformLocation* location = 0;
+    long index = -1;
+    
+    if (functionForUniform(f))
+        location = toWebGLUniformLocation(args.at(0));
+    else
+        index = args.at(0).toInt32(exec);
+
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch (f) {
+        case f_uniform1v:
+            context->uniform1fv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform2v:
+            context->uniform2fv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform3v:
+            context->uniform3fv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform4v:
+            context->uniform4fv(location, webGLArray.get(), ec);
+            break;
+        case f_vertexAttrib1v:
+            context->vertexAttrib1fv(index, webGLArray.get());
+            break;
+        case f_vertexAttrib2v:
+            context->vertexAttrib2fv(index, webGLArray.get());
+            break;
+        case f_vertexAttrib3v:
+            context->vertexAttrib3fv(index, webGLArray.get());
+            break;
+        case f_vertexAttrib4v:
+            context->vertexAttrib4fv(index, webGLArray.get());
+            break;
+        }
+        
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    Vector<float, 64> array;
+    if (!toVector(exec, args.at(1), array))
+        return throwError(exec, TypeError);
+
+    switch (f) {
+    case f_uniform1v:
+        context->uniform1fv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform2v:
+        context->uniform2fv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform3v:
+        context->uniform3fv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform4v:
+        context->uniform4fv(location, array.data(), array.size(), ec);
+        break;
+    case f_vertexAttrib1v:
+        context->vertexAttrib1fv(index, array.data(), array.size());
+        break;
+    case f_vertexAttrib2v:
+        context->vertexAttrib2fv(index, array.data(), array.size());
+        break;
+    case f_vertexAttrib3v:
+        context->vertexAttrib3fv(index, array.data(), array.size());
+        break;
+    case f_vertexAttrib4v:
+        context->vertexAttrib4fv(index, array.data(), array.size());
+        break;
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+  
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLIntArray> webGLArray = toWebGLIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch (f) {
+        case f_uniform1v:
+            context->uniform1iv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform2v:
+            context->uniform2iv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform3v:
+            context->uniform3iv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform4v:
+            context->uniform4iv(location, webGLArray.get(), ec);
+            break;
+        default:
+            break;
+        }
+        
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+
+    Vector<int, 64> array;
+    if (!toVector(exec, args.at(1), array))
+        return throwError(exec, TypeError);
+
+    switch (f) {
+    case f_uniform1v:
+        context->uniform1iv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform2v:
+        context->uniform2iv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform3v:
+        context->uniform3iv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform4v:
+        context->uniform4iv(location, array.data(), array.size(), ec);
+        break;
+    default:
+        break;
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch (f) {
+        case f_uniformMatrix2fv:
+            context->uniformMatrix2fv(location, transpose, webGLArray.get(), ec);
+            break;
+        case f_uniformMatrix3fv:
+            context->uniformMatrix3fv(location, transpose, webGLArray.get(), ec);
+            break;
+        case f_uniformMatrix4fv:
+            context->uniformMatrix4fv(location, transpose, webGLArray.get(), ec);
+            break;
+        }
+        
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    Vector<float, 64> array;
+    if (!toVector(exec, args.at(2), array))
+        return throwError(exec, TypeError);
+
+    switch (f) {
+    case f_uniformMatrix2fv:
+        context->uniformMatrix2fv(location, transpose, array.data(), array.size(), ec);
+        break;
+    case f_uniformMatrix3fv:
+        context->uniformMatrix3fv(location, transpose, array.data(), array.size(), ec);
+        break;
+    case f_uniformMatrix4fv:
+        context->uniformMatrix4fv(location, transpose, array.data(), array.size(), ec);
+        break;
+    }
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
index a885b7b..a33779b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
@@ -27,37 +27,41 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasShortArrayConstructor.h"
+#include "JSWebGLShortArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasShortArray.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasShortArray.h"
+#include "WebGLShortArray.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLShortArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLShortArrayConstructor::s_info = { "WebGLShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLShortArrayConstructor::JSWebGLShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLShortArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
-    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
+    JSWebGLShortArrayConstructor* jsConstructor = static_cast<JSWebGLShortArrayConstructor*>(constructor);
+    RefPtr<WebGLShortArray> array = static_cast<WebGLShortArray*>(construct<WebGLShortArray, short>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasShortArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
index df21825..7807a13 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasShortArrayConstructor_h
-#define JSCanvasShortArrayConstructor_h
+#ifndef JSWebGLShortArrayConstructor_h
+#define JSWebGLShortArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
+    class JSWebGLShortArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasShortArrayConstructor_h
+#endif // JSWebGLShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
index 95a80a7..899b0c9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedIntArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLShortArray.h"
 
-#include "CanvasUnsignedIntArray.h"
+#include "WebGLShortArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
-    impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLShortArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed short>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLShortArray* shortArray = toWebGLShortArray(args.at(0));
+    if (shortArray) {
+        // void set(in WebGLShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(shortArray, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
index 5d0800e..dcb940e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
@@ -27,36 +27,41 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedByteArrayConstructor.h"
+#include "JSWebGLUnsignedByteArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedByteArray.h"
+#include "ExceptionCode.h"
+#include "WebGLUnsignedByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedByteArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedByteArrayConstructor::s_info = { "WebGLUnsignedByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedByteArrayConstructor::JSWebGLUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedByteArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
+    JSWebGLUnsignedByteArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedByteArray> array = static_cast<WebGLUnsignedByteArray*>(construct<WebGLUnsignedByteArray, unsigned char>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedByteArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
index 6016159..d90ce96 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasUnsignedIntArrayConstructor_h
-#define JSCanvasUnsignedIntArrayConstructor_h
+#ifndef JSWebGLUnsignedByteArrayConstructor_h
+#define JSWebGLUnsignedByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
+    class JSWebGLUnsignedByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasUnsignedIntArrayConstructor_h
+#endif // JSWebGLUnsignedByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
index f2b0c74..b576374 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedByteArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedByteArray.h"
 
-#include "CanvasUnsignedByteArray.h"
+#include "WebGLUnsignedByteArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedByteArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<unsigned char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedByteArray* array = toWebGLUnsignedByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
index 5f145a7..23fccce 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
@@ -27,36 +27,40 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedIntArrayConstructor.h"
+#include "JSWebGLUnsignedIntArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedIntArray.h"
+#include "WebGLUnsignedIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedIntArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedIntArrayConstructor::s_info = { "WebGLUnsignedIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedIntArrayConstructor::JSWebGLUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedIntArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
+    JSWebGLUnsignedIntArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedIntArray> array = static_cast<WebGLUnsignedIntArray*>(construct<WebGLUnsignedIntArray, unsigned int>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedIntArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000..7eabbc1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLUnsignedIntArrayConstructor_h
+#define JSWebGLUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLUnsignedIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000..c8b7454
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedIntArray.h"
+
+#include "WebGLUnsignedIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned int>(value.toUInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedIntArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<unsigned int>(args.at(1).toUInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedIntArray* array = toWebGLUnsignedIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
index 9735693..d8c2cfb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
@@ -27,36 +27,40 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedShortArrayConstructor.h"
+#include "JSWebGLUnsignedShortArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedShortArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedShortArray.h"
+#include "WebGLUnsignedShortArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedShortArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedShortArrayConstructor::s_info = { "WebGLUnsignedShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedShortArrayConstructor::JSWebGLUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedShortArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
+    JSWebGLUnsignedShortArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedShortArray> array = static_cast<WebGLUnsignedShortArray*>(construct<WebGLUnsignedShortArray, unsigned short>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedShortArray;
     return ConstructTypeHost;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
index 9cfb721..5eba20d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasUnsignedByteArrayConstructor_h
-#define JSCanvasUnsignedByteArrayConstructor_h
+#ifndef JSWebGLUnsignedShortArrayConstructor_h
+#define JSWebGLUnsignedShortArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
+    class JSWebGLUnsignedShortArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasUnsignedByteArrayConstructor_h
+#endif // JSWebGLUnsignedShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
index 290cd4b..0c82c3e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedShortArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedShortArray.h"
 
-#include "CanvasUnsignedShortArray.h"
+#include "WebGLUnsignedShortArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedShortArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<unsigned short>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedShortArray* array = toWebGLUnsignedShortArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
index 069647a..633e612 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
@@ -31,6 +31,8 @@
 #ifndef JSWebSocketConstructor_h
 #define JSWebSocketConstructor_h
 
+#if ENABLE(WEB_SOCKETS)
+
 #include "JSDOMBinding.h"
 
 namespace WebCore {
@@ -45,6 +47,8 @@ class JSWebSocketConstructor : public DOMConstructorObject {
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 };
 
-}  // namespace WebCore
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
 
-#endif  // JSWebSocketConstructor_h
+#endif // JSWebSocketConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
index 33c3fcd..d610f01 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -38,7 +38,6 @@
 #include "KURL.h"
 #include "JSEventListener.h"
 #include "WebSocket.h"
-#include "NotImplemented.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -66,7 +65,7 @@ JSValue JSWebSocket::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -76,7 +75,7 @@ JSValue JSWebSocket::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
index 741a269..2491f4d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -42,10 +42,10 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 
-const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
+const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", &JSDOMGlobalObject::s_info, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
-    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
+    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData(normalWorld(*impl->script()->globalData())), this)
     , m_impl(impl)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 490d9b1..bf9409c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -32,8 +32,10 @@
 #include "JSDOMBinding.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEventListener.h"
+#include "JSEventSourceConstructor.h"
 #include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSWebSocketConstructor.h"
 #include "JSWorkerLocation.h"
 #include "JSWorkerNavigator.h"
 #include "JSXMLHttpRequestConstructor.h"
@@ -43,10 +45,6 @@
 #include "WorkerNavigator.h"
 #include <interpreter/Interpreter.h>
 
-#if ENABLE(EVENTSOURCE)
-#include "JSEventSourceConstructor.h"
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
@@ -62,7 +60,7 @@ void JSWorkerContext::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
 
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -93,6 +91,13 @@ JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
 }
 
+#if ENABLE(WEB_SOCKETS)
+JSValue JSWorkerContext::webSocket(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebSocketConstructor>(exec, this);
+}
+#endif
+
 JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 {
     if (!args.size())
@@ -122,7 +127,7 @@ JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -132,26 +137,26 @@ JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& arg
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setTimeout(action, delay));
+    return jsNumber(exec, impl()->setTimeout(action.release(), delay));
 }
 
 JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setInterval(action, delay));
+    return jsNumber(exec, impl()->setInterval(action.release(), delay));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 7ee2720..ede5a25 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -29,18 +29,20 @@
 #include "config.h"
 #include "JSXMLHttpRequest.h"
 
+#include "Blob.h"
+#include "DOMFormData.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "Event.h"
-#include "File.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "JSBlob.h"
+#include "JSDOMFormData.h"
 #include "JSDOMWindowCustom.h"
 #include "JSDocument.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
-#include "JSFile.h"
 #include "XMLHttpRequest.h"
 #include <runtime/Error.h>
 #include <interpreter/Interpreter.h>
@@ -56,7 +58,7 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
     if (XMLHttpRequestUpload* upload = m_impl->optionalUpload())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), upload);
 
-    m_impl->markEventListeners(markStack);
+    m_impl->markJSEventListeners(markStack);
 }
 
 // Custom functions
@@ -67,21 +69,23 @@ JSValue JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
 
     const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(1).toString(exec));
     String method = args.at(0).toString(exec);
-    bool async = true;
-    if (args.size() >= 3)
-        async = args.at(2).toBoolean(exec);
 
     ExceptionCode ec = 0;
-    if (args.size() >= 4 && !args.at(3).isUndefined()) {
-        String user = valueToStringWithNullCheck(exec, args.at(3));
-
-        if (args.size() >= 5 && !args.at(4).isUndefined()) {
-            String password = valueToStringWithNullCheck(exec, args.at(4));
-            impl()->open(method, url, async, user, password, ec);
+    if (args.size() >= 3) {
+        bool async = args.at(2).toBoolean(exec);
+
+        if (args.size() >= 4 && !args.at(3).isUndefined()) {
+            String user = valueToStringWithNullCheck(exec, args.at(3));
+            
+            if (args.size() >= 5 && !args.at(4).isUndefined()) {
+                String password = valueToStringWithNullCheck(exec, args.at(4));
+                impl()->open(method, url, async, user, password, ec);
+            } else
+                impl()->open(method, url, async, user, ec);
         } else
-            impl()->open(method, url, async, user, ec);
+            impl()->open(method, url, async, ec);
     } else
-        impl()->open(method, url, async, ec);
+        impl()->open(method, url, ec);
 
     setDOMException(exec, ec);
     return jsUndefined();
@@ -109,8 +113,10 @@ JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
             impl()->send(ec);
         else if (val.inherits(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val.inherits(&JSFile::s_info))
-            impl()->send(toFile(val), ec);
+        else if (val.inherits(&JSBlob::s_info))
+            impl()->send(toBlob(val), ec);
+        else if (val.inherits(&JSDOMFormData::s_info))
+            impl()->send(toDOMFormData(val), ec);
         else
             impl()->send(val.toString(exec), ec);
     }
@@ -153,7 +159,7 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -163,7 +169,7 @@ JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& ar
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index fa7cfec..857c12d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -48,7 +48,7 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
     if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), xmlHttpRequest);
 
-    m_impl->markEventListeners(markStack);
+    m_impl->markJSEventListeners(markStack);
 }
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
@@ -57,7 +57,7 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -67,7 +67,7 @@ JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgLi
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.cpp
new file mode 100644
index 0000000..8e56ed8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.cpp
@@ -0,0 +1,183 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JavaScriptProfile.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "JavaScriptProfileNode.h"
+#include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <JavaScriptCore/OpaqueJSString.h>
+#include <profiler/Profile.h>
+#include <runtime/JSObject.h>
+#include <runtime/JSValue.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+// Cache
+
+typedef HashMap<Profile*, JSObject*> ProfileMap;
+
+static ProfileMap& profileCache()
+{
+    DEFINE_STATIC_LOCAL(ProfileMap, staticProfiles, ());
+    return staticProfiles;
+}
+
+// Static Values
+
+static JSClassRef ProfileClass();
+
+static JSValueRef getTitleCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeString(ctx, OpaqueJSString::create(profile->title()).get());
+}
+
+static JSValueRef getHeadCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ExecState* exec = toJS(ctx);
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    return toRef(exec, toJS(exec, profile->head()));
+}
+
+static JSValueRef getUniqueIdCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profile->uid());
+}
+
+// Static Functions
+
+static JSValueRef focus(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(ctx);
+
+    if (!JSValueIsObjectOfClass(ctx, arguments[0], ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    profile->focus(static_cast<ProfileNode*>(JSObjectGetPrivate(const_cast<JSObjectRef>(arguments[0]))));
+
+    return JSValueMakeUndefined(ctx);
+}
+
+static JSValueRef exclude(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(ctx);
+
+    if (!JSValueIsObjectOfClass(ctx, arguments[0], ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    profile->exclude(static_cast<ProfileNode*>(JSObjectGetPrivate(const_cast<JSObjectRef>(arguments[0]))));
+
+    return JSValueMakeUndefined(ctx);
+}
+
+static JSValueRef restoreAll(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    profile->restoreAll();
+
+    return JSValueMakeUndefined(ctx);
+}
+
+static void finalize(JSObjectRef object)
+{
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(object));
+    profileCache().remove(profile);
+    profile->deref();
+}
+
+JSClassRef ProfileClass()
+{
+    static JSStaticValue staticValues[] = {
+        { "title", getTitleCallback, 0, kJSPropertyAttributeNone },
+        { "head", getHeadCallback, 0, kJSPropertyAttributeNone },
+        { "uid", getUniqueIdCallback, 0, kJSPropertyAttributeNone },
+        { 0, 0, 0, 0 }
+    };
+
+    static JSStaticFunction staticFunctions[] = {
+        { "focus", focus, kJSPropertyAttributeNone },
+        { "exclude", exclude, kJSPropertyAttributeNone },
+        { "restoreAll", restoreAll, kJSPropertyAttributeNone },
+        { 0, 0, 0 }
+    };
+
+    static JSClassDefinition classDefinition = {
+        0, kJSClassAttributeNone, "Profile", 0, staticValues, staticFunctions,
+        0, finalize, 0, 0, 0, 0, 0, 0, 0, 0, 0
+    };
+
+    static JSClassRef profileClass = JSClassCreate(&classDefinition);
+    return profileClass;
+}
+
+JSValue toJS(ExecState* exec, Profile* profile)
+{
+    if (!profile)
+        return jsNull();
+
+    JSObject* profileWrapper = profileCache().get(profile);
+    if (profileWrapper)
+        return profileWrapper;
+
+    profile->ref();
+    profileWrapper = toJS(JSObjectMake(toRef(exec), ProfileClass(), static_cast<void*>(profile)));
+    profileCache().set(profile, profileWrapper);
+    return profileWrapper;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.h b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.h
new file mode 100644
index 0000000..7b75b97
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaScriptProfile_h
+#define JavaScriptProfile_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include <runtime/JSValue.h>
+
+namespace JSC {
+class ExecState;
+class Profile;
+}
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState*, JSC::Profile*);
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.cpp
new file mode 100644
index 0000000..7d60b24
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.cpp
@@ -0,0 +1,236 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JavaScriptProfileNode.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "JSDOMBinding.h"
+#include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSContextRef.h>
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSRetainPtr.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <profiler/ProfileNode.h>
+#include <runtime/JSLock.h>
+#include <runtime/JSValue.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+// Cache
+
+typedef HashMap<ProfileNode*, JSObject*> ProfileNodeMap;
+
+static ProfileNodeMap& profileNodeCache()
+{
+    DEFINE_STATIC_LOCAL(ProfileNodeMap, staticProfileNodes, ());
+    return staticProfileNodes;
+}
+
+static JSValueRef getFunctionName(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    JSRetainPtr<JSStringRef> functionNameString(Adopt, JSStringCreateWithCharacters(profileNode->functionName().data(), profileNode->functionName().size()));
+    return JSValueMakeString(ctx, functionNameString.get());
+}
+
+static JSValueRef getURL(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    JSRetainPtr<JSStringRef> urlString(Adopt, JSStringCreateWithCharacters(profileNode->url().data(), profileNode->url().size()));
+    return JSValueMakeString(ctx, urlString.get());
+}
+
+static JSValueRef getLineNumber(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->lineNumber());
+}
+
+static JSValueRef getTotalTime(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->totalTime());
+}
+
+static JSValueRef getSelfTime(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->selfTime());
+}
+
+static JSValueRef getNumberOfCalls(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->numberOfCalls());
+}
+
+static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef* exception)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    const Vector<RefPtr<ProfileNode> >& children = profileNode->children();
+
+    JSObjectRef global = JSContextGetGlobalObject(ctx);
+
+    JSRetainPtr<JSStringRef> arrayString(Adopt, JSStringCreateWithUTF8CString("Array"));
+
+    JSValueRef arrayProperty = JSObjectGetProperty(ctx, global, arrayString.get(), exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    JSObjectRef arrayConstructor = JSValueToObject(ctx, arrayProperty, exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    JSObjectRef result = JSObjectCallAsConstructor(ctx, arrayConstructor, 0, 0, exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    JSRetainPtr<JSStringRef> pushString(Adopt, JSStringCreateWithUTF8CString("push"));
+
+    JSValueRef pushProperty = JSObjectGetProperty(ctx, result, pushString.get(), exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    JSObjectRef pushFunction = JSValueToObject(ctx, pushProperty, exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    ExecState* exec = toJS(ctx);
+    for (Vector<RefPtr<ProfileNode> >::const_iterator it = children.begin(); it != children.end(); ++it) {
+        JSValueRef arg0 = toRef(exec, toJS(exec, (*it).get() ));
+        JSObjectCallAsFunction(ctx, pushFunction, result, 1, &arg0, exception);
+        if (exception && *exception)
+            return JSValueMakeUndefined(ctx);
+    }
+
+    return result;
+}
+
+static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeBoolean(ctx, profileNode->visible());
+}
+
+static JSValueRef getCallUID(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->callIdentifier().hash());
+}
+
+static void finalize(JSObjectRef object)
+{
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(object));
+    profileNodeCache().remove(profileNode);
+    profileNode->deref();
+}
+
+JSClassRef ProfileNodeClass()
+{
+    static JSStaticValue staticValues[] = {
+        { "functionName", getFunctionName, 0, kJSPropertyAttributeNone },
+        { "url", getURL, 0, kJSPropertyAttributeNone },
+        { "lineNumber", getLineNumber, 0, kJSPropertyAttributeNone },
+        { "totalTime", getTotalTime, 0, kJSPropertyAttributeNone },
+        { "selfTime", getSelfTime, 0, kJSPropertyAttributeNone },
+        { "numberOfCalls", getNumberOfCalls, 0, kJSPropertyAttributeNone },
+        { "children", getChildren, 0, kJSPropertyAttributeNone },
+        { "visible", getVisible, 0, kJSPropertyAttributeNone },
+        { "callUID", getCallUID, 0, kJSPropertyAttributeNone },
+        { 0, 0, 0, 0 }
+    };
+
+    static JSClassDefinition classDefinition = {
+        0, kJSClassAttributeNone, "ProfileNode", 0, staticValues, 0,
+        0, finalize, 0, 0, 0, 0, 0, 0, 0, 0, 0
+    };
+
+    static JSClassRef profileNodeClass = JSClassCreate(&classDefinition);
+    return profileNodeClass;
+}
+
+JSValue toJS(ExecState* exec, ProfileNode* profileNode)
+{
+    if (!profileNode)
+        return jsNull();
+
+    JSObject* profileNodeWrapper = profileNodeCache().get(profileNode);
+    if (profileNodeWrapper)
+        return profileNodeWrapper;
+
+    profileNode->ref();
+
+    profileNodeWrapper = toJS(JSObjectMake(toRef(exec), ProfileNodeClass(), static_cast<void*>(profileNode)));
+    profileNodeCache().set(profileNode, profileNodeWrapper);
+    return profileNodeWrapper;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.h b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.h
new file mode 100644
index 0000000..f01be19
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaScriptProfileNode_h
+#define JavaScriptProfileNode_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include <JavaScriptCore/JSBase.h>
+#include <runtime/JSValue.h>
+
+namespace JSC {
+class ExecState;
+class ProfileNode;
+}
+
+namespace WebCore {
+
+JSClassRef ProfileNodeClass();
+JSC::JSValue toJS(JSC::ExecState*, JSC::ProfileNode*);
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index 9a21b6b..6dea50e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -47,7 +47,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args, DOMWrapperWorld* isolatedWorld)
+PassOwnPtr<ScheduledAction> ScheduledAction::create(ExecState* exec, const ArgList& args, DOMWrapperWorld* isolatedWorld)
 {
     JSValue v = args.at(0);
     CallData callData;
@@ -103,7 +103,7 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
         args.append(m_args[i]);
 
     globalObject->globalData()->timeoutChecker.start();
-    callInWorld(exec, m_function, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSC::call(exec, m_function, callType, callData, thisValue, args);
     globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
@@ -117,7 +117,7 @@ void ScheduledAction::execute(Document* document)
         return;
 
     RefPtr<Frame> frame = window->impl()->frame();
-    if (!frame || !frame->script()->isEnabled())
+    if (!frame || !frame->script()->canExecuteScripts(AboutToExecuteScript))
         return;
 
     frame->script()->setProcessingTimerCallback(true);
@@ -126,7 +126,7 @@ void ScheduledAction::execute(Document* document)
         executeFunctionInContext(window, window->shell());
         Document::updateStyleForAllDocuments();
     } else
-        frame->script()->executeScriptInIsolatedWorld(m_isolatedWorld.get(), m_code);
+        frame->script()->executeScriptInWorld(m_isolatedWorld.get(), m_code);
 
     frame->script()->setProcessingTimerCallback(false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
index 4ea727d..3b7e001 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
@@ -24,6 +24,7 @@
 #include <JSDOMBinding.h>
 #include <runtime/JSCell.h>
 #include <runtime/Protect.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
@@ -40,9 +41,9 @@ namespace WebCore {
     * time interval, either once or repeatedly. Used for window.setTimeout()
     * and window.setInterval()
     */
-    class ScheduledAction {
+    class ScheduledAction : public Noncopyable {
     public:
-        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
+        static PassOwnPtr<ScheduledAction> create(JSC::ExecState*, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
 
         void execute(ScriptExecutionContext*);
 
@@ -56,7 +57,7 @@ namespace WebCore {
 
         void executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue thisValue);
         void execute(Document*);
-#if ENABLE(WORKERS)        
+#if ENABLE(WORKERS)
         void execute(WorkerContext*);
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
index 2c4075a..caecc40 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
@@ -53,6 +53,10 @@ static bool handleException(ScriptState* scriptState)
 
 bool ScriptArray::set(unsigned index, const ScriptObject& value)
 {
+    if (value.scriptState() != m_scriptState) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
     JSLock lock(SilenceAssertionsOnly);
     jsArray()->put(m_scriptState, index, value.jsObject());
     return handleException(m_scriptState);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
index e01324e..16f18d3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -44,19 +44,26 @@ using namespace JSC;
 namespace WebCore {
 
 ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
+    : m_domWindow(0)
 {
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        m_window = windowShell->window();
-        scriptController->attachDebugger(0);
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        JSDOMWindow* window = iter->second->window();
+        m_windows.add(iter->first.get(), window);
+        m_domWindow = window->impl();
     }
+
+    scriptController->attachDebugger(0);
 }
 
-DOMWindow* ScriptCachedFrameData::domWindow() const {
-    return m_window ? m_window->impl() : 0;
+DOMWindow* ScriptCachedFrameData::domWindow() const
+{
+    return m_domWindow;
 }
 
 ScriptCachedFrameData::~ScriptCachedFrameData()
@@ -66,31 +73,37 @@ ScriptCachedFrameData::~ScriptCachedFrameData()
 
 void ScriptCachedFrameData::restore(Frame* frame)
 {
-    Page* page = frame->page();
-
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        if (m_window)
-            windowShell->setWindow(m_window.get());
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        DOMWrapperWorld* world = iter->first.get();
+        JSDOMWindowShell* windowShell = iter->second.get();
+
+        if (JSDOMWindow* window = m_windows.get(world))
+            windowShell->setWindow(window);
         else {
             windowShell->setWindow(frame->domWindow());
-            scriptController->attachDebugger(page->debugger());
-            windowShell->window()->setProfileGroup(page->group().identifier());
+
+            if (Page* page = frame->page()) {
+                scriptController->attachDebugger(windowShell, page->debugger());
+                windowShell->window()->setProfileGroup(page->group().identifier());
+            }
         }
     }
 }
 
 void ScriptCachedFrameData::clear()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    if (m_windows.isEmpty())
+        return;
 
-    if (m_window) {
-        m_window = 0;
-        gcController().garbageCollectSoon();
-    }
+    JSLock lock(SilenceAssertionsOnly);
+    m_windows.clear();
+    gcController().garbageCollectSoon();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
index c661f28..15c23c5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
@@ -38,8 +38,11 @@ namespace WebCore {
     class Frame;
     class JSDOMWindow;
     class DOMWindow;
+    class DOMWrapperWorld;
+
+    class ScriptCachedFrameData  : public Noncopyable {
+        typedef HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindow> > JSDOMWindowSet;
 
-    class ScriptCachedFrameData  {
     public:
         ScriptCachedFrameData(Frame*);
         ~ScriptCachedFrameData();
@@ -49,7 +52,8 @@ namespace WebCore {
         DOMWindow* domWindow() const;
 
     private:
-        JSC::ProtectedPtr<JSDOMWindow> m_window;
+        JSDOMWindowSet m_windows;
+        DOMWindow* m_domWindow;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
index 021ede5..c8eadd1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
@@ -54,14 +54,15 @@ ScriptCallStack::ScriptCallStack(ExecState* exec, const ArgList& args, unsigned
 
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, urlString, function);
 
+    unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
+
     if (function) {
         m_caller = asInternalFunction(function);
-        unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(m_caller->name(m_exec), urlString, lineNumber, args, skipArgumentCount));
     } else {
         // Caller is unknown, but we should still add the frame, because
         // something called us, and gave us arguments.
-        m_frames.append(ScriptCallFrame(UString(), UString(), 0, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(UString(), urlString, lineNumber, args, skipArgumentCount));
     }
 }
 
@@ -94,10 +95,15 @@ void ScriptCallStack::initialize()
     while (!func.isNull()) {
         InternalFunction* internalFunction = asInternalFunction(func);
         ArgList emptyArgList;
-        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, emptyArgList, 0));
+        m_frames.append(ScriptCallFrame(internalFunction->name(m_exec), UString(), 0, emptyArgList, 0));
         func = m_exec->interpreter()->retrieveCaller(m_exec, internalFunction);
     }
     m_initialized = true;
 }
 
+bool ScriptCallStack::callLocation(String*, int*)
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h
index 1907564..f5f8ae0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h
@@ -49,9 +49,11 @@ namespace WebCore {
         ~ScriptCallStack();
 
         ScriptState* state() const { return m_exec; }
+        ScriptState* globalState() const { return m_exec->lexicalGlobalObject()->globalExec(); }
         // frame retrieval methods
         const ScriptCallFrame &at(unsigned);
         unsigned size();
+        static bool callLocation(String*, int*);
 
     private:
         void initialize();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index 4a1d413..f6b779a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -25,8 +25,10 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "GCController.h"
 #include "HTMLPlugInElement.h"
+#include "InspectorTimelineAgent.h"
 #include "JSDocument.h"
 #include "NP_jsobject.h"
 #include "Page.h"
@@ -35,6 +37,7 @@
 #include "ScriptValue.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
+#include "WebCoreJSClientData.h"
 #include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
@@ -43,6 +46,7 @@
 #include <runtime/JSLock.h>
 
 using namespace JSC;
+using namespace std;
 
 namespace WebCore {
 
@@ -79,9 +83,6 @@ ScriptController::ScriptController(Frame* frame)
 ScriptController::~ScriptController()
 {
     if (!m_windowShells.isEmpty()) {
-        for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-            iter->first->forgetScriptController(this);
-
         m_windowShells.clear();
     
         // It's likely that releasing the global object has created a lot of garbage.
@@ -102,7 +103,7 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
     }
 
     // evaluate code. Returns the JS return value or 0
-    // if there was none, an error occured or the type couldn't be converted.
+    // if there was none, an error occurred or the type couldn't be converted.
 
     // inlineCode is true for <a href="javascript:doSomething()">
     // and false for <script>doSomething()</script>. Check if it has the
@@ -117,10 +118,20 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
 
     RefPtr<Frame> protect = m_frame;
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->willEvaluateScript(sourceURL, sourceCode.startLine());
+#endif
+
     exec->globalData().timeoutChecker.start();
-    Completion comp = WebCore::evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell, world);
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell);
     exec->globalData().timeoutChecker.stop();
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->didEvaluateScript();
+#endif
+
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
     m_frame->keepAlive();
@@ -145,53 +156,26 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 // An DOMWrapperWorld other than the thread's normal world.
 class IsolatedWorld : public DOMWrapperWorld {
 public:
+    static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
+
+protected:
     IsolatedWorld(JSGlobalData* globalData)
-        : DOMWrapperWorld(globalData)
+        : DOMWrapperWorld(globalData, false)
     {
         JSGlobalData::ClientData* clientData = globalData->clientData;
         ASSERT(clientData);
         static_cast<WebCoreJSClientData*>(clientData)->rememberWorld(this);
     }
-
-    static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
 };
 
-static PassRefPtr<IsolatedWorld> findWorld(unsigned worldID)
+PassRefPtr<DOMWrapperWorld> ScriptController::createWorld()
 {
-    if (!worldID)
-        return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-
-    typedef HashMap<unsigned, RefPtr<IsolatedWorld> > WorldMap;
-    DEFINE_STATIC_LOCAL(WorldMap, isolatedWorlds, ());
-
-    WorldMap::iterator iter = isolatedWorlds.find(worldID);
-    if (iter != isolatedWorlds.end())
-        return iter->second;
-
-    RefPtr<IsolatedWorld> newWorld = IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-    isolatedWorlds.add(worldID, newWorld);
-    return newWorld;
+    return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
 }
 
-JSDOMWindow* ScriptController::globalObject(unsigned worldID)
+void ScriptController::getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
 {
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return windowShell(world.get())->window();
-}
-
-ScriptValue ScriptController::evaluateInIsolatedWorld(unsigned worldID, const ScriptSourceCode& sourceCode) 
-{
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return evaluateInWorld(sourceCode, world.get());
-}
-
-void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sourceCode) 
-{
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-
-    unsigned size = sourceCode.size();
-    for (unsigned i = 0; i < size; ++i)
-        evaluateInWorld(sourceCode[i], world.get());
+    static_cast<WebCoreJSClientData*>(JSDOMWindow::commonJSGlobalData()->clientData)->getAllWorlds(worlds);
 }
 
 void ScriptController::clearWindowShell()
@@ -201,19 +185,17 @@ void ScriptController::clearWindowShell()
 
     JSLock lock(SilenceAssertionsOnly);
 
-    // Clear the debugger from the current window before setting the new window.
-    DOMWrapperWorld* debugWorld = debuggerWorld();
-    attachDebugger(0);
-
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
-        DOMWrapperWorld* world = iter->first;
         JSDOMWindowShell* windowShell = iter->second;
+
+        // Clear the debugger from the current window before setting the new window.
+        attachDebugger(windowShell, 0);
+
         windowShell->window()->willRemoveFromWindowShell();
         windowShell->setWindow(m_frame->domWindow());
 
         if (Page* page = m_frame->page()) {
-            if (world == debugWorld)
-                attachDebugger(page->debugger());
+            attachDebugger(windowShell, page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
         }
     }
@@ -228,53 +210,33 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 
     JSLock lock(SilenceAssertionsOnly);
 
-    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow());
+    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow(), world);
     m_windowShells.add(world, windowShell);
-    world->rememberScriptController(this);
-    windowShell->window()->updateDocument(world);
+    windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
-        if (world == debuggerWorld())
-            attachDebugger(page->debugger());
+        attachDebugger(windowShell, page->debugger());
         windowShell->window()->setProfileGroup(page->group().identifier());
     }
 
-    {
-        EnterDOMWrapperWorld worldEntry(*JSDOMWindow::commonJSGlobalData(), world);
-        m_frame->loader()->dispatchWindowObjectAvailable();
-    }
+    m_frame->loader()->dispatchDidClearWindowObjectInWorld(world);
 
     return windowShell;
 }
 
-bool ScriptController::processingUserGesture() const
+bool ScriptController::processingUserGesture(DOMWrapperWorld* world) const
 {
-    return m_allowPopupsFromPlugin || processingUserGestureEvent() || isJavaScriptAnchorNavigation();
+    return m_allowPopupsFromPlugin || processingUserGestureEvent(world) || isJavaScriptAnchorNavigation();
 }
 
-bool ScriptController::processingUserGestureEvent() const
+bool ScriptController::processingUserGestureEvent(DOMWrapperWorld* world) const
 {
-    JSDOMWindowShell* shell = existingWindowShell(mainThreadNormalWorld());
+    JSDOMWindowShell* shell = existingWindowShell(world);
     if (!shell)
         return false;
 
-    if (Event* event = shell->window()->currentEvent()) {
-        if (event->createdByDOM())
-            return false;
-
-        const AtomicString& type = event->type();
-        if ( // mouse events
-            type == eventNames().clickEvent || type == eventNames().mousedownEvent ||
-            type == eventNames().mouseupEvent || type == eventNames().dblclickEvent ||
-            // keyboard events
-            type == eventNames().keydownEvent || type == eventNames().keypressEvent ||
-            type == eventNames().keyupEvent ||
-            // other accepted events
-            type == eventNames().selectEvent || type == eventNames().changeEvent ||
-            type == eventNames().focusEvent || type == eventNames().blurEvent ||
-            type == eventNames().submitEvent)
-            return true;
-    }
+    if (Event* event = shell->window()->currentEvent())
+        return event->fromUserGesture();
     
     return false;
 }
@@ -300,7 +262,20 @@ bool ScriptController::anyPageIsProcessingUserGesture() const
     HashSet<Page*>::const_iterator end = pages.end();
     for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
         for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->script()->processingUserGesture())
+            ScriptController* script = frame->script();
+
+            if (script->m_allowPopupsFromPlugin)
+                return true;
+
+            const ShellMap::const_iterator iterEnd = m_windowShells.end();
+            for (ShellMap::const_iterator iter = m_windowShells.begin(); iter != iterEnd; ++iter) {
+                JSDOMWindowShell* shell = iter->second.get();
+                Event* event = shell->window()->currentEvent();
+                if (event && event->fromUserGesture())
+                    return true;
+            }
+
+            if (isJavaScriptAnchorNavigation())
                 return true;
         }
     }
@@ -308,16 +283,14 @@ bool ScriptController::anyPageIsProcessingUserGesture() const
     return false;
 }
 
-bool ScriptController::isEnabled()
+void ScriptController::attachDebugger(JSC::Debugger* debugger)
 {
-    Settings* settings = m_frame->settings();
-    return (settings && settings->isJavaScriptEnabled());
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
+        attachDebugger(iter->second, debugger);
 }
 
-void ScriptController::attachDebugger(JSC::Debugger* debugger)
+void ScriptController::attachDebugger(JSDOMWindowShell* shell, JSC::Debugger* debugger)
 {
-    // FIXME: Should be able to debug isolated worlds.
-    JSDOMWindowShell* shell = existingWindowShell(debuggerWorld());
     if (!shell)
         return;
 
@@ -335,7 +308,7 @@ void ScriptController::updateDocument()
 
     JSLock lock(SilenceAssertionsOnly);
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-        iter->second->window()->updateDocument(iter->first);
+        iter->second->window()->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -345,7 +318,7 @@ void ScriptController::updateSecurityOrigin()
 
 Bindings::RootObject* ScriptController::bindingRootObject()
 {
-    if (!isEnabled())
+    if (!canExecuteScripts(NotAboutToExecuteScript))
         return 0;
 
     if (!m_bindingRootObject) {
@@ -372,7 +345,7 @@ PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* native
 NPObject* ScriptController::windowScriptNPObject()
 {
     if (!m_windowScriptNPObject) {
-        if (isEnabled()) {
+        if (canExecuteScripts(NotAboutToExecuteScript)) {
             // JavaScript is enabled, so there is a JavaScript window object.
             // Return an NPObject bound to the window object.
             JSC::JSLock lock(SilenceAssertionsOnly);
@@ -405,7 +378,7 @@ NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement
 JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
 {
     // Can't create JSObjects when JavaScript is disabled
-    if (!isEnabled())
+    if (!canExecuteScripts(NotAboutToExecuteScript))
         return 0;
 
     // Create a JSObject bound to this element
@@ -468,31 +441,11 @@ void ScriptController::clearScriptObjects()
 #endif
 }
 
-ScriptValue ScriptController::executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture)
-{
-    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
-
-    if (!isEnabled() || isPaused())
-        return ScriptValue();
-
-    bool wasInExecuteScript = m_inExecuteScript;
-    m_inExecuteScript = true;
-
-    ScriptValue result = evaluateInIsolatedWorld(worldID, sourceCode);
-
-    if (!wasInExecuteScript) {
-        m_inExecuteScript = false;
-        Document::updateStyleForAllDocuments();
-    }
-
-    return result;
-}
-
-ScriptValue ScriptController::executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
+ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
 {
     ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
 
-    if (!isEnabled() || isPaused())
+    if (!canExecuteScripts(AboutToExecuteScript) || isPaused())
         return ScriptValue();
 
     bool wasInExecuteScript = m_inExecuteScript;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index f2a497d..6af1736 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -62,13 +62,21 @@ class XSSAuditor;
 
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
+enum ReasonForCallingCanExecuteScripts {
+    AboutToExecuteScript,
+    NotAboutToExecuteScript
+};
+
 class ScriptController {
-    typedef WTF::HashMap<DOMWrapperWorld*, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
+    friend class ScriptCachedFrameData;
+    typedef WTF::HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
 
 public:
     ScriptController(Frame*);
     ~ScriptController();
 
+    static PassRefPtr<DOMWrapperWorld> createWorld();
+
     JSDOMWindowShell* windowShell(DOMWrapperWorld* world)
     {
         ShellMap::iterator iter = m_windowShells.find(world);
@@ -83,17 +91,12 @@ public:
     {
         return windowShell(world)->window();
     }
-    JSDOMWindow* globalObject(unsigned worldID);
 
-    void forgetWorld(DOMWrapperWorld* world)
-    {
-        m_windowShells.remove(world);
-    }
+    static void getAllWorlds(Vector<DOMWrapperWorld*>&);
 
     ScriptValue executeScript(const ScriptSourceCode&);
     ScriptValue executeScript(const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
 
     // Returns true if argument is a JavaScript URL.
     bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
@@ -104,19 +107,19 @@ public:
 
     ScriptValue evaluate(const ScriptSourceCode&);
     ScriptValue evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*);
-    ScriptValue evaluateInIsolatedWorld(unsigned /*worldID*/, const ScriptSourceCode&);
-    void evaluateInIsolatedWorld(unsigned /*worldID*/, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
 
     void setProcessingTimerCallback(bool b) { m_processingTimerCallback = b; }
-    bool processingUserGesture() const;
+    bool processingUserGesture(DOMWrapperWorld*) const;
     bool anyPageIsProcessingUserGesture() const;
 
-    bool isEnabled();
+    bool canExecuteScripts(ReasonForCallingCanExecuteScripts);
 
-    void attachDebugger(JSC::Debugger*);
+    // Debugger can be 0 to detach any existing Debugger.
+    void attachDebugger(JSC::Debugger*); // Attaches/detaches in all worlds/window shells.
+    void attachDebugger(JSDOMWindowShell*, JSC::Debugger*);
 
     void setPaused(bool b) { m_paused = b; }
     bool isPaused() const { return m_paused; }
@@ -166,7 +169,7 @@ private:
 
     void disconnectPlatformScriptObjects();
 
-    bool processingUserGestureEvent() const;
+    bool processingUserGestureEvent(DOMWrapperWorld*) const;
     bool isJavaScriptAnchorNavigation() const;
 
     ShellMap m_windowShells;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerBrew.cpp
index 20cd805c0..d8d345a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerBrew.cpp
@@ -1,5 +1,8 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Apple Computer, Inc.
+ * Copyright (C) 2009 Company 100, Inc.
+ *
+ * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,31 +23,25 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
+#include "ScriptController.h"
 
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasFloatArray.h"
-
-#include "CanvasFloatArray.h"
-
-using namespace JSC;
+#include "Bridge.h"
+#include "PluginView.h"
+#include "runtime_root.h"
 
 namespace WebCore {
 
-void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(WebCore::Widget* widget)
 {
-    impl()->set(index, static_cast<float>(value.toInt32(exec)));
-}
+    if (!widget->isPluginView())
+        return 0;
+
+    return static_cast<PluginView*>(widget)->bindingInstance();
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp
index c906034..6ffae69 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp
@@ -31,9 +31,9 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
 #include "runtime_root.h"
-#include "runtime.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
index 3fe471d..a1f1590 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
-#include "runtime.h"
 #include "runtime_root.h"
 
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
index 21ec0f2..a895489 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
@@ -29,6 +29,7 @@
 #import "config.h"
 #import "ScriptController.h"
 
+#import "Bridge.h"
 #import "DOMAbstractViewFrame.h"
 #import "DOMWindow.h"
 #import "Frame.h"
@@ -37,6 +38,8 @@
 #import "JSDOMWindow.h"
 #import "WebScriptObjectPrivate.h"
 #import "Widget.h"
+#import "objc_instance.h"
+#import "runtime_root.h"
 #import <JavaScriptCore/APICast.h>
 #import <runtime/JSLock.h>
 
@@ -46,12 +49,8 @@
 #import "npruntime_impl.h"
 #endif
 
-#import "objc_instance.h"
-#import "runtime_root.h"
-#import "runtime.h"
-
 #if ENABLE(MAC_JAVA_BRIDGE)
-#import "jni_instance.h"
+#import "JavaInstanceJSC.h"
 #endif
 
 @interface NSObject (WebPlugin)
@@ -108,7 +107,7 @@ PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widge
 
 WebScriptObject* ScriptController::windowScriptObject()
 {
-    if (!isEnabled())
+    if (!canExecuteScripts(NotAboutToExecuteScript))
         return 0;
 
     if (!m_windowScriptObject) {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp
index 6b14190..55d4ba4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp
@@ -36,11 +36,11 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "DOMWindow.h"
 #include "PluginView.h"
 #include "qt_instance.h"
 #include "runtime_root.h"
-#include "runtime.h"
 
 #include <QWidget>
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp
index 703cf7c..e0a959e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
-#include "runtime.h"
 
 using namespace JSC::Bindings;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp
index 1c14928..1d7b4ca 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp
@@ -27,9 +27,9 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
 #include "runtime_root.h"
-#include "runtime.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.cpp
new file mode 100644
index 0000000..5305da3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -0,0 +1,586 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "DOMWindow.h"
+#include "EventLoop.h"
+#include "Frame.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "JSDOMWindowCustom.h"
+#include "JavaScriptCallFrame.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "PluginView.h"
+#include "ScriptBreakpoint.h"
+#include "ScriptController.h"
+#include "ScriptDebugListener.h"
+#include "ScrollView.h"
+#include "Widget.h"
+#include <debugger/DebuggerCallFrame.h>
+#include <parser/SourceCode.h>
+#include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptDebugServer& ScriptDebugServer::shared()
+{
+    DEFINE_STATIC_LOCAL(ScriptDebugServer, server, ());
+    return server;
+}
+
+ScriptDebugServer::ScriptDebugServer()
+    : m_callingListeners(false)
+    , m_pauseOnExceptionsState(DontPauseOnExceptions)
+    , m_pauseOnNextStatement(false)
+    , m_paused(false)
+    , m_doneProcessingDebuggerEvents(true)
+    , m_breakpointsActivated(true)
+    , m_pauseOnCallFrame(0)
+    , m_recompileTimer(this, &ScriptDebugServer::recompileAllJSFunctions)
+{
+}
+
+ScriptDebugServer::~ScriptDebugServer()
+{
+    deleteAllValues(m_pageListenersMap);
+}
+
+void ScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
+{
+    ASSERT_ARG(listener, listener);
+    ASSERT_ARG(page, page);
+
+    pair<PageListenersMap::iterator, bool> result = m_pageListenersMap.add(page, 0);
+    if (result.second)
+        result.first->second = new ListenerSet;
+
+    ListenerSet* listeners = result.first->second;
+    listeners->add(listener);
+
+    didAddListener(page);
+}
+
+void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
+{
+    ASSERT_ARG(listener, listener);
+    ASSERT_ARG(page, page);
+
+    PageListenersMap::iterator it = m_pageListenersMap.find(page);
+    if (it == m_pageListenersMap.end())
+        return;
+
+    ListenerSet* listeners = it->second;
+    listeners->remove(listener);
+    if (listeners->isEmpty()) {
+        m_pageListenersMap.remove(it);
+        delete listeners;
+    }
+
+    didRemoveListener(page);
+    if (!hasListeners())
+        didRemoveLastListener();
+}
+
+void ScriptDebugServer::pageCreated(Page* page)
+{
+    ASSERT_ARG(page, page);
+
+    if (!hasListenersInterestedInPage(page))
+        return;
+    page->setDebugger(this);
+}
+
+bool ScriptDebugServer::hasListenersInterestedInPage(Page* page)
+{
+    ASSERT_ARG(page, page);
+
+    if (hasGlobalListeners())
+        return true;
+
+    return m_pageListenersMap.contains(page);
+}
+
+void ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint)
+{
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    BreakpointsMap::iterator it = m_breakpoints.find(sourceIDValue);
+    if (it == m_breakpoints.end())
+        it = m_breakpoints.set(sourceIDValue, SourceBreakpoints()).first;
+    it->second.set(lineNumber, breakpoint);
+}
+
+void ScriptDebugServer::removeBreakpoint(const String& sourceID, unsigned lineNumber)
+{
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    BreakpointsMap::iterator it = m_breakpoints.find(sourceIDValue);
+    if (it != m_breakpoints.end())
+        it->second.remove(lineNumber);
+}
+
+bool ScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const
+{
+    if (!m_breakpointsActivated)
+        return false;
+
+    BreakpointsMap::const_iterator it = m_breakpoints.find(sourceID);
+    if (it == m_breakpoints.end())
+        return false;
+    SourceBreakpoints::const_iterator breakIt = it->second.find(lineNumber);
+    if (breakIt == it->second.end() || !breakIt->second.enabled)
+        return false;
+
+    // An empty condition counts as no condition which is equivalent to "true".
+    if (breakIt->second.condition.isEmpty())
+        return true;
+
+    JSValue exception;
+    JSValue result = m_currentCallFrame->evaluate(breakIt->second.condition, exception);
+    if (exception) {
+        // An erroneous condition counts as "false".
+        return false;
+    }
+    return result.toBoolean(m_currentCallFrame->scopeChain()->globalObject->globalExec());
+}
+
+void ScriptDebugServer::clearBreakpoints()
+{
+    m_breakpoints.clear();
+}
+
+void ScriptDebugServer::setBreakpointsActivated(bool activated)
+{
+    m_breakpointsActivated = activated;
+}
+
+void ScriptDebugServer::setPauseOnExceptionsState(PauseOnExceptionsState pause)
+{
+    m_pauseOnExceptionsState = pause;
+}
+
+void ScriptDebugServer::pauseProgram()
+{
+    m_pauseOnNextStatement = true;
+}
+
+void ScriptDebugServer::continueProgram()
+{
+    if (!m_paused)
+        return;
+
+    m_pauseOnNextStatement = false;
+    m_doneProcessingDebuggerEvents = true;
+}
+
+void ScriptDebugServer::stepIntoStatement()
+{
+    if (!m_paused)
+        return;
+
+    m_pauseOnNextStatement = true;
+    m_doneProcessingDebuggerEvents = true;
+}
+
+void ScriptDebugServer::stepOverStatement()
+{
+    if (!m_paused)
+        return;
+
+    m_pauseOnCallFrame = m_currentCallFrame.get();
+    m_doneProcessingDebuggerEvents = true;
+}
+
+void ScriptDebugServer::stepOutOfFunction()
+{
+    if (!m_paused)
+        return;
+
+    m_pauseOnCallFrame = m_currentCallFrame ? m_currentCallFrame->caller() : 0;
+    m_doneProcessingDebuggerEvents = true;
+}
+
+JavaScriptCallFrame* ScriptDebugServer::currentCallFrame()
+{
+    if (!m_paused)
+        return 0;
+    return m_currentCallFrame.get();
+}
+
+ScriptState* ScriptDebugServer::currentCallFrameState()
+{
+    if (!m_paused)
+        return 0;
+    return m_currentCallFrame->scopeChain()->globalObject->globalExec();        
+}
+
+void ScriptDebugServer::dispatchDidParseSource(const ListenerSet& listeners, const JSC::SourceCode& source)
+{
+    String sourceID = JSC::UString(JSC::UString::from(source.provider()->asID()));
+    String url = source.provider()->url();
+    String data = JSC::UString(source.data(), source.length());
+    int firstLine = source.firstLine();
+
+    Vector<ScriptDebugListener*> copy;
+    copyToVector(listeners, copy);
+    for (size_t i = 0; i < copy.size(); ++i)
+        copy[i]->didParseSource(sourceID, url, data, firstLine);
+}
+
+void ScriptDebugServer::dispatchFailedToParseSource(const ListenerSet& listeners, const SourceCode& source, int errorLine, const String& errorMessage)
+{
+    String url = source.provider()->url();
+    String data = JSC::UString(source.data(), source.length());
+    int firstLine = source.firstLine();
+
+    Vector<ScriptDebugListener*> copy;
+    copyToVector(listeners, copy);
+    for (size_t i = 0; i < copy.size(); ++i)
+        copy[i]->failedToParseSource(url, data, firstLine, errorLine, errorMessage);
+}
+
+static Page* toPage(JSGlobalObject* globalObject)
+{
+    ASSERT_ARG(globalObject, globalObject);
+
+    JSDOMWindow* window = asJSDOMWindow(globalObject);
+    Frame* frame = window->impl()->frame();
+    return frame ? frame->page() : 0;
+}
+
+void ScriptDebugServer::detach(JSGlobalObject* globalObject)
+{
+    // If we're detaching from the currently executing global object, manually tear down our
+    // stack, since we won't get further debugger callbacks to do so. Also, resume execution,
+    // since there's no point in staying paused once a window closes.
+    if (m_currentCallFrame && m_currentCallFrame->dynamicGlobalObject() == globalObject) {
+        m_currentCallFrame = 0;
+        m_pauseOnCallFrame = 0;
+        continueProgram();
+    }
+    Debugger::detach(globalObject);
+}
+
+void ScriptDebugServer::sourceParsed(ExecState* exec, const SourceCode& source, int errorLine, const UString& errorMessage)
+{
+    if (m_callingListeners)
+        return;
+
+    Page* page = toPage(exec->dynamicGlobalObject());
+    if (!page)
+        return;
+
+    m_callingListeners = true;
+
+    bool isError = errorLine != -1;
+
+    if (hasGlobalListeners()) {
+        if (isError)
+            dispatchFailedToParseSource(m_listeners, source, errorLine, errorMessage);
+        else
+            dispatchDidParseSource(m_listeners, source);
+    }
+
+    if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
+        ASSERT(!pageListeners->isEmpty());
+        if (isError)
+            dispatchFailedToParseSource(*pageListeners, source, errorLine, errorMessage);
+        else
+            dispatchDidParseSource(*pageListeners, source);
+    }
+
+    m_callingListeners = false;
+}
+
+void ScriptDebugServer::dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback)
+{
+    Vector<ScriptDebugListener*> copy;
+    copyToVector(listeners, copy);
+    for (size_t i = 0; i < copy.size(); ++i)
+        (copy[i]->*callback)();
+}
+
+void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback callback, Page* page)
+{
+    if (m_callingListeners)
+        return;
+
+    m_callingListeners = true;
+
+    ASSERT(hasListeners());
+
+    dispatchFunctionToListeners(m_listeners, callback);
+
+    if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
+        ASSERT(!pageListeners->isEmpty());
+        dispatchFunctionToListeners(*pageListeners, callback);
+    }
+
+    m_callingListeners = false;
+}
+
+void ScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool paused)
+{
+    setMainThreadCallbacksPaused(paused);
+
+    const HashSet<Page*>& pages = pageGroup.pages();
+
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it)
+        setJavaScriptPaused(*it, paused);
+}
+
+void ScriptDebugServer::setJavaScriptPaused(Page* page, bool paused)
+{
+    ASSERT_ARG(page, page);
+
+    page->setDefersLoading(paused);
+
+    for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
+        setJavaScriptPaused(frame, paused);
+}
+
+void ScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
+{
+    ASSERT_ARG(frame, frame);
+
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
+        return;
+
+    frame->script()->setPaused(paused);
+
+    Document* document = frame->document();
+    if (paused)
+        document->suspendActiveDOMObjects();
+    else
+        document->resumeActiveDOMObjects();
+
+    setJavaScriptPaused(frame->view(), paused);
+}
+
+void ScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
+{
+    if (!view)
+        return;
+
+    const HashSet<RefPtr<Widget> >* children = view->children();
+    ASSERT(children);
+
+    HashSet<RefPtr<Widget> >::const_iterator end = children->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != end; ++it) {
+        Widget* widget = (*it).get();
+        if (!widget->isPluginView())
+            continue;
+        static_cast<PluginView*>(widget)->setJavaScriptPaused(paused);
+    }
+}
+
+void ScriptDebugServer::pauseIfNeeded(Page* page)
+{
+    if (m_paused)
+        return;
+
+    if (!page || !hasListenersInterestedInPage(page))
+        return;
+
+    bool pauseNow = m_pauseOnNextStatement;
+    pauseNow |= (m_pauseOnCallFrame == m_currentCallFrame);
+    pauseNow |= (m_currentCallFrame->line() > 0 && hasBreakpoint(m_currentCallFrame->sourceID(), m_currentCallFrame->line()));
+    if (!pauseNow)
+        return;
+
+    m_pauseOnCallFrame = 0;
+    m_pauseOnNextStatement = false;
+    m_paused = true;
+
+    dispatchFunctionToListeners(&ScriptDebugListener::didPause, page);
+
+    setJavaScriptPaused(page->group(), true);
+
+    TimerBase::fireTimersInNestedEventLoop();
+
+    EventLoop loop;
+    m_doneProcessingDebuggerEvents = false;
+    while (!m_doneProcessingDebuggerEvents && !loop.ended())
+        loop.cycle();
+
+    setJavaScriptPaused(page->group(), false);
+
+    m_paused = false;
+
+    dispatchFunctionToListeners(&ScriptDebugListener::didContinue, page);
+}
+
+void ScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    m_currentCallFrame = JavaScriptCallFrame::create(debuggerCallFrame, m_currentCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+
+    // Treat stepping over a return statement like stepping out.
+    if (m_currentCallFrame == m_pauseOnCallFrame)
+        m_pauseOnCallFrame = m_currentCallFrame->caller();
+    m_currentCallFrame = m_currentCallFrame->caller();
+}
+
+void ScriptDebugServer::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, bool hasHandler)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    if (m_pauseOnExceptionsState == PauseOnAllExceptions || (m_pauseOnExceptionsState == PauseOnUncaughtExceptions && !hasHandler))
+        m_pauseOnNextStatement = true;
+
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    m_currentCallFrame = JavaScriptCallFrame::create(debuggerCallFrame, m_currentCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+
+    // Treat stepping over the end of a program like stepping out.
+    if (m_currentCallFrame == m_pauseOnCallFrame)
+        m_pauseOnCallFrame = m_currentCallFrame->caller();
+    m_currentCallFrame = m_currentCallFrame->caller();
+}
+
+void ScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    m_pauseOnNextStatement = true;
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::recompileAllJSFunctionsSoon()
+{
+    m_recompileTimer.startOneShot(0);
+}
+
+void ScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
+}
+
+void ScriptDebugServer::didAddListener(Page* page)
+{
+    recompileAllJSFunctionsSoon();
+
+    if (page)
+        page->setDebugger(this);
+    else
+        Page::setDebuggerForAllPages(this);
+}
+
+void ScriptDebugServer::didRemoveListener(Page* page)
+{
+    if (hasGlobalListeners() || (page && hasListenersInterestedInPage(page)))
+        return;
+
+    recompileAllJSFunctionsSoon();
+
+    if (page)
+        page->setDebugger(0);
+    else
+        Page::setDebuggerForAllPages(0);
+}
+
+void ScriptDebugServer::didRemoveLastListener()
+{
+    m_doneProcessingDebuggerEvents = true;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.h
new file mode 100644
index 0000000..4740585
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptDebugServer_h
+#define ScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "PlatformString.h"
+#include "ScriptBreakpoint.h"
+#include "ScriptState.h"
+#include "Timer.h"
+
+#include <debugger/Debugger.h>
+#include <runtime/UString.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+class DebuggerCallFrame;
+class JSGlobalObject;
+}
+namespace WebCore {
+
+class Frame;
+class FrameView;
+class Page;
+class PageGroup;
+class ScriptDebugListener;
+class JavaScriptCallFrame;
+
+class ScriptDebugServer : JSC::Debugger, public Noncopyable {
+public:
+    static ScriptDebugServer& shared();
+
+    void addListener(ScriptDebugListener*, Page*);
+    void removeListener(ScriptDebugListener*, Page*);
+
+    void setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint);
+    void removeBreakpoint(const String& sourceID, unsigned lineNumber);
+    void clearBreakpoints();
+    void setBreakpointsActivated(bool activated);
+
+    enum PauseOnExceptionsState {
+        DontPauseOnExceptions,
+        PauseOnAllExceptions,
+        PauseOnUncaughtExceptions
+    };
+    PauseOnExceptionsState pauseOnExceptionsState() const { return m_pauseOnExceptionsState; }
+    void setPauseOnExceptionsState(PauseOnExceptionsState);
+
+    void pauseProgram();
+    void continueProgram();
+    void stepIntoStatement();
+    void stepOverStatement();
+    void stepOutOfFunction();
+
+    void recompileAllJSFunctionsSoon();
+    void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0);
+
+    JavaScriptCallFrame* currentCallFrame();
+    ScriptState* currentCallFrameState();
+
+    void pageCreated(Page*);
+
+private:
+    typedef HashSet<ScriptDebugListener*> ListenerSet;
+    typedef void (ScriptDebugListener::*JavaScriptExecutionCallback)();
+
+    ScriptDebugServer();
+    ~ScriptDebugServer();
+
+    bool hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const;
+    bool hasListeners() const { return !m_listeners.isEmpty() || !m_pageListenersMap.isEmpty(); }
+    bool hasGlobalListeners() const { return !m_listeners.isEmpty(); }
+    bool hasListenersInterestedInPage(Page*);
+
+    void setJavaScriptPaused(const PageGroup&, bool paused);
+    void setJavaScriptPaused(Page*, bool paused);
+    void setJavaScriptPaused(Frame*, bool paused);
+    void setJavaScriptPaused(FrameView*, bool paused);
+
+    void dispatchFunctionToListeners(JavaScriptExecutionCallback, Page*);
+    void dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback);
+    void dispatchDidParseSource(const ListenerSet& listeners, const JSC::SourceCode& source);
+    void dispatchFailedToParseSource(const ListenerSet& listeners, const JSC::SourceCode& source, int errorLine, const String& errorMessage);
+
+    void pauseIfNeeded(Page*);
+
+    virtual void detach(JSC::JSGlobalObject*);
+
+    virtual void sourceParsed(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMsg);
+    virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
+    virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int firstLine);
+    virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
+    virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler);
+    virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+    virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+    virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+
+    void didAddListener(Page*);
+    void didRemoveListener(Page*);
+    void didRemoveLastListener();
+
+    typedef HashMap<Page*, ListenerSet*> PageListenersMap;
+    typedef HashMap<intptr_t, SourceBreakpoints> BreakpointsMap;
+
+    PageListenersMap m_pageListenersMap;
+    ListenerSet m_listeners;
+    bool m_callingListeners;
+    PauseOnExceptionsState m_pauseOnExceptionsState;
+    bool m_pauseOnNextStatement;
+    bool m_paused;
+    bool m_doneProcessingDebuggerEvents;
+    bool m_breakpointsActivated;
+    JavaScriptCallFrame* m_pauseOnCallFrame;
+    RefPtr<JavaScriptCallFrame> m_currentCallFrame;
+    BreakpointsMap m_breakpoints;
+    Timer<ScriptDebugServer> m_recompileTimer;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // ScriptDebugServer_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
index 8399c7a..afa8784 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
@@ -37,6 +37,7 @@
 #include "JSNode.h"
 #include "Frame.h"
 #include "XSSAuditor.h"
+#include <runtime/JSLock.h>
 
 using namespace JSC;
 
@@ -52,14 +53,18 @@ static const String& eventParameterName(bool isSVGEvent)
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
 {
     ASSERT(node);
+    ASSERT(attr);
+    if (attr->isNull())
+        return 0;
 
     int lineNumber = 1;
     String sourceURL;
+    JSObject* wrapper = 0;
     
     // FIXME: We should be able to provide accurate source information for frameless documents, too (e.g. for importing nodes from XMLHttpRequest.responseXML).
     if (Frame* frame = node->document()->frame()) {
         ScriptController* scriptController = frame->script();
-        if (!scriptController->isEnabled())
+        if (!scriptController->canExecuteScripts(AboutToExecuteScript))
             return 0;
 
         if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
@@ -69,9 +74,13 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
 
         lineNumber = scriptController->eventHandlerLineNumber();
         sourceURL = node->document()->url().string();
+
+        JSC::JSLock lock(SilenceAssertionsOnly);
+        JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(node->document(), mainThreadNormalWorld());
+        wrapper = asObject(toJS(globalObject->globalExec(), globalObject, node));
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, wrapper, mainThreadNormalWorld());
 }
 
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -79,11 +88,15 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!frame)
         return 0;
 
+    ASSERT(attr);
+    if (attr->isNull())
+        return 0;
+
     int lineNumber = 1;
     String sourceURL;
     
     ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
+    if (!scriptController->canExecuteScripts(AboutToExecuteScript))
         return 0;
 
     if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
@@ -93,15 +106,19 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
 
     lineNumber = scriptController->eventHandlerLineNumber();
     sourceURL = frame->document()->url().string();
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, mainThreadNormalWorld());
+    JSObject* wrapper = toJSDOMWindow(frame, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, wrapper, mainThreadNormalWorld());
 }
 
 String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* eventListener)
 {
-    JSC::JSObject* functionObject = eventListener->jsFunction(context);
-    if (!functionObject)
+    const JSEventListener* jsListener = JSEventListener::cast(eventListener);
+    if (!jsListener)
+        return "";
+    JSC::JSObject* jsFunction = jsListener->jsFunction(context);
+    if (!jsFunction)
         return "";
-    return functionObject->toString(scriptState);
+    return jsFunction->toString(scriptState);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
index 91b2a57..5001d3c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -42,8 +42,8 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name)
-    : m_exec(exec)
+ScriptFunctionCall::ScriptFunctionCall(const ScriptObject& thisObject, const String& name)
+    : m_exec(thisObject.scriptState())
     , m_thisObject(thisObject)
     , m_name(name)
 {
@@ -51,6 +51,10 @@ ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& th
 
 void ScriptFunctionCall::appendArgument(const ScriptObject& argument)
 {
+    if (argument.scriptState() != m_exec) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
     m_arguments.append(argument.jsObject());
 }
 
@@ -72,14 +76,27 @@ void ScriptFunctionCall::appendArgument(const String& argument)
 
 void ScriptFunctionCall::appendArgument(const JSC::UString& argument)
 {
+    JSLock lock(SilenceAssertionsOnly);
     m_arguments.append(jsString(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(const char* argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsString(m_exec, UString(argument)));
+}
+
 void ScriptFunctionCall::appendArgument(JSC::JSValue argument)
 {
     m_arguments.append(argument);
 }
 
+void ScriptFunctionCall::appendArgument(long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(long long argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -92,6 +109,12 @@ void ScriptFunctionCall::appendArgument(unsigned int argument)
     m_arguments.append(jsNumber(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(unsigned long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(int argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -123,8 +146,7 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
     if (callType == CallTypeNone)
         return ScriptValue();
 
-    // FIXME: Should this function take a worldID? - only used by inspector?
-    JSValue result = callInWorld(m_exec, function, callType, callData, thisObject, m_arguments, debuggerWorld());
+    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
@@ -162,8 +184,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
     if (constructType == ConstructTypeNone)
         return ScriptObject();
 
-    // FIXME: Currently this method constructs objects in debuggerWorld().  We could use the current world, or pass a worldID to this function?
-    JSValue result = constructInWorld(m_exec, constructor, constructType, constructData, m_arguments, debuggerWorld());
+    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
index 079ac21..9742e8f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
@@ -48,17 +48,20 @@ namespace WebCore {
 
     class ScriptFunctionCall {
     public:
-        ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name);
+        ScriptFunctionCall(const ScriptObject& thisObject, const String& name);
         virtual ~ScriptFunctionCall() {};
 
         void appendArgument(const ScriptObject&);
         void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
+        void appendArgument(const char*);
         void appendArgument(const JSC::UString&);
         void appendArgument(JSC::JSValue);
+        void appendArgument(long);
         void appendArgument(long long);
         void appendArgument(unsigned int);
+        void appendArgument(unsigned long);
         void appendArgument(int);
         void appendArgument(bool);
         ScriptValue call(bool& hadException, bool reportExceptions = true);
@@ -70,6 +73,12 @@ namespace WebCore {
         ScriptObject m_thisObject;
         String m_name;
         JSC::MarkedArgumentBuffer m_arguments;
+
+    private:
+        // MarkedArgumentBuffer must be stack allocated, so prevent heap
+        // alloc of ScriptFunctionCall as well.
+        void* operator new(size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
+        void* operator new[](size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h
index 3095df9..0b3b59f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h
@@ -31,8 +31,8 @@
 #ifndef ScriptInstance_h
 #define ScriptInstance_h
 
+#include "Bridge.h"
 #include <wtf/RefPtr.h>
-#include "runtime.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
index 1172e8e..7948219 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -32,10 +32,15 @@
 #include "ScriptObject.h"
 
 #include "JSDOMBinding.h"
-#include "JSInspectorBackend.h"
 
 #include <runtime/JSLock.h>
 
+#if ENABLE(INSPECTOR)
+#include "JSInjectedScriptHost.h"
+#include "JSInspectorBackend.h"
+#include "JSInspectorFrontendHost.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -65,6 +70,10 @@ bool ScriptObject::set(const String& name, const String& value)
 
 bool ScriptObject::set(const char* name, const ScriptObject& value)
 {
+    if (value.scriptState() != m_scriptState) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
     jsObject()->put(m_scriptState, Identifier(m_scriptState, name), value.jsObject(), slot);
@@ -87,6 +96,14 @@ bool ScriptObject::set(const char* name, double value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, long long value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -111,6 +128,14 @@ bool ScriptObject::set(const char* name, unsigned value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -140,6 +165,22 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorFrontendHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InjectedScriptHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
 #endif // ENABLE(INSPECTOR)
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
index 31381f3..0c993e1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -38,21 +38,26 @@
 #include <runtime/Protect.h>
 
 namespace WebCore {
+    class InjectedScriptHost;
     class InspectorBackend;
+    class InspectorFrontendHost;
 
     class ScriptObject : public ScriptValue {
     public:
         ScriptObject(ScriptState*, JSC::JSObject*);
         ScriptObject() {}
         JSC::JSObject* jsObject() const { return asObject(jsValue()); }
+        ScriptState* scriptState() const { return m_scriptState; }
 
         bool set(const String& name, const String&);
         bool set(const char* name, const ScriptObject&);
         bool set(const char* name, const String&);
         bool set(const char* name, double);
+        bool set(const char* name, long);
         bool set(const char* name, long long);
         bool set(const char* name, int);
         bool set(const char* name, unsigned);
+        bool set(const char* name, unsigned long);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -66,6 +71,8 @@ namespace WebCore {
         static bool set(ScriptState*, const char* name, const ScriptObject&);
 #if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+        static bool set(ScriptState*, const char* name, InspectorFrontendHost*);
+        static bool set(ScriptState*, const char* name, InjectedScriptHost*);
 #endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
deleted file mode 100644
index 313530f..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptObjectQuarantine.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Document.h"
-#include "Frame.h"
-#include "JSDOMBinding.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSNode.h"
-#include "ScriptObject.h"
-#include "ScriptValue.h"
-#include "Storage.h"
-
-#include <runtime/JSLock.h>
-
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "JSDatabase.h"
-#endif
-
-#if ENABLE(DOM_STORAGE)
-#include "JSStorage.h"
-#endif
-
-using namespace JSC;
-
-namespace WebCore {
-
-ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
-}
-
-#if ENABLE(DATABASE)
-bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
-{
-    ASSERT(database);
-
-    Frame* frame = database->document()->frame();
-    if (!frame)
-        return false;
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, database))));
-
-    return true;
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
-{
-    ASSERT(storage);
-    Frame* frame = storage->frame();
-    ASSERT(frame);
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, storage))));
-
-    return true;
-}
-#endif
-
-bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
-{
-    ExecState* exec = scriptStateFromNode(node);
-    if (!exec)
-        return false;
-
-    JSLock lock(SilenceAssertionsOnly);
-    // FIXME: Should use some sort of globalObjectFromNode()
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, deprecatedGlobalObjectForPrototype(exec), node))));
-
-    return true;
-}
-
-bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
-{
-    ASSERT(domWindow);
-
-    JSDOMWindow* window = toJSDOMWindow(domWindow->frame(), debuggerWorld());
-    ExecState* exec = window->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, window)));
-
-    return true;
-}
-
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfile.h
index 21af0a6..32095e3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfile.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,31 +21,21 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
+#ifndef ScriptProfile_h
+#define ScriptProfile_h
 
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasShortArray.h"
-
-#include "CanvasShortArray.h"
-
-using namespace JSC;
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include <profiler/Profile.h>
 
 namespace WebCore {
 
-void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
-}
+typedef JSC::Profile ScriptProfile;
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // ScriptProfile_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.cpp
index 8442b87..789e3d3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.cpp
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,31 +21,29 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 
-#include "JSCanvasIntArray.h"
+#include "ScriptProfiler.h"
 
-#include "CanvasIntArray.h"
-
-using namespace JSC;
+#include <profiler/Profiler.h>
 
 namespace WebCore {
 
-void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void ScriptProfiler::start(ScriptState* state, const String& title)
 {
-    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+    JSC::Profiler::profiler()->startProfiling(state, title);
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
+PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String& title)
 {
-    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
+    return JSC::Profiler::profiler()->stopProfiling(state, title);
 }
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.h
index 04697ce..a86bcfb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,31 +21,28 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
+#ifndef ScriptProfiler_h
+#define ScriptProfiler_h
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "ScriptProfile.h"
+#include "ScriptState.h"
 
-#include "JSCanvasByteArray.h"
-
-#include "CanvasByteArray.h"
-
-using namespace JSC;
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
-void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
-}
+class ScriptProfiler : public Noncopyable {
+public:
+    static void start(ScriptState* state, const String& title);
+    static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
+};
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // ScriptProfiler_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
index 60ba2a0..3edd1bd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
@@ -38,7 +38,13 @@
 
 namespace WebCore {
 
-ScriptState* scriptStateFromNode(Node* node)
+ScriptState* mainWorldScriptState(Frame* frame)
+{
+    JSDOMWindowShell* shell = frame->script()->windowShell(mainThreadNormalWorld());
+    return shell->window()->globalExec();
+}
+
+ScriptState* scriptStateFromNode(DOMWrapperWorld* world, Node* node)
 {
     if (!node)
         return 0;
@@ -48,14 +54,14 @@ ScriptState* scriptStateFromNode(Node* node)
     Frame* frame = document->frame();
     if (!frame)
         return 0;
-    if (!frame->script()->isEnabled())
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
         return 0;
-    return frame->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return frame->script()->globalObject(world)->globalExec();
 }
 
-ScriptState* scriptStateFromPage(Page* page)
+ScriptState* scriptStateFromPage(DOMWrapperWorld* world, Page* page)
 {
-    return page->mainFrame()->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return page->mainFrame()->script()->globalObject(world)->globalExec();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
index 279234e..0c7c575 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
@@ -36,6 +36,7 @@
 
 namespace WebCore {
     class DOMWrapperWorld;
+    class Frame;
     class Node;
     class Page;
 
@@ -45,8 +46,10 @@ namespace WebCore {
     // For now, the separation is purely by convention.
     typedef JSC::ExecState ScriptState;
 
-    ScriptState* scriptStateFromNode(Node*);
-    ScriptState* scriptStateFromPage(Page*);
+    ScriptState* mainWorldScriptState(Frame*);
+
+    ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node*);
+    ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
index 6dab9a0..18964b8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
@@ -33,6 +33,7 @@
 
 #include "PlatformString.h"
 #include <runtime/UString.h>
+#include <runtime/StringBuilder.h>
 
 namespace WebCore {
 
@@ -57,7 +58,10 @@ public:
 
     ScriptString& operator+=(const String& s)
     {
-        m_str += s;
+        JSC::StringBuilder buffer;
+        buffer.append(m_str);
+        buffer.append(s);
+        m_str = buffer.build();
         return *this;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
index 6eac102..005c329 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "ScriptValue.h"
 
+#include "SerializedScriptValue.h"
+
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSValueRef.h>
 
@@ -40,13 +42,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool ScriptValue::getString(String& result) const
+bool ScriptValue::getString(ScriptState* scriptState, String& result) const
 {
     if (!m_value)
         return false;
     JSLock lock(SilenceAssertionsOnly);
     UString ustring;
-    if (!m_value.get().getString(ustring))
+    if (!m_value.get().getString(scriptState, ustring))
         return false;
     result = ustring;
     return true;
@@ -81,4 +83,14 @@ bool ScriptValue::isObject() const
     return m_value.get().isObject();
 }
 
+PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState)
+{
+    return SerializedScriptValue::create(scriptState, jsValue());
+}
+
+ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value)
+{
+    return ScriptValue(value->deserialize(scriptState, scriptState->lexicalGlobalObject()));
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
index 19bb693..3d0d944 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
@@ -33,11 +33,14 @@
 
 #include "PlatformString.h"
 #include "ScriptState.h"
+#include <runtime/JSValue.h>
 #include <runtime/Protect.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
 class String;
+class SerializedScriptValue;
 
 class ScriptValue {
 public:
@@ -45,7 +48,7 @@ public:
     virtual ~ScriptValue() {}
 
     JSC::JSValue jsValue() const { return m_value.get(); }
-    bool getString(String& result) const;
+    bool getString(ScriptState*, String& result) const;
     String toString(ScriptState* scriptState) const { return m_value.get().toString(scriptState); }
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
@@ -53,6 +56,11 @@ public:
     bool isObject() const;
     bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
+    PassRefPtr<SerializedScriptValue> serialize(ScriptState*);
+    static ScriptValue deserialize(ScriptState*, SerializedScriptValue*);
+
+    static ScriptValue undefined() { return ScriptValue(JSC::jsUndefined()); }
+
 private:
     JSC::ProtectedJSValue m_value;
 };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptWrappable.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptWrappable.h
new file mode 100644
index 0000000..5e99c1c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptWrappable.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptWrappable_h
+#define ScriptWrappable_h
+
+#include "JSDOMWrapper.h"
+#include <runtime/WeakGCPtr.h>
+
+namespace WebCore {
+
+class ScriptWrappable {
+public:
+    ScriptWrappable() : m_wrapper(0) { }
+    
+    DOMObject* wrapper() const
+    {
+        return m_wrapper.get();
+    }
+    
+    void setWrapper(DOMObject* wrapper)
+    {
+        ASSERT(wrapper);
+        m_wrapper = wrapper;
+    }
+    
+    void clearWrapper(DOMObject* wrapper) 
+    { 
+        m_wrapper.clear(wrapper); 
+    }
+    
+private:
+    JSC::WeakGCPtr<DOMObject> m_wrapper;
+};
+
+} // namespace WebCore
+
+#endif // ScriptWrappable_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
index 48cd92d..fbf8899 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -27,9 +27,19 @@
 #include "config.h"
 #include "SerializedScriptValue.h"
 
+#include "File.h"
+#include "FileList.h"
+#include "ImageData.h"
+#include "JSDOMGlobalObject.h"
+#include "JSFile.h"
+#include "JSFileList.h"
+#include "JSImageData.h"
+#include <JavaScriptCore/APICast.h>
 #include <runtime/DateInstance.h>
 #include <runtime/ExceptionHelpers.h>
+#include <runtime/JSLock.h>
 #include <runtime/PropertyNameArray.h>
+#include <wtf/ByteArray.h>
 #include <wtf/HashTraits.h>
 #include <wtf/Vector.h>
 
@@ -136,6 +146,52 @@ private:
     unsigned m_length;
 };
 
+class SerializedFileList : public SharedSerializedData {
+public:
+    static PassRefPtr<SerializedFileList> create(const FileList* list)
+    {
+        return adoptRef(new SerializedFileList(list));
+    }
+
+    unsigned length() const { return m_files.size(); }
+    const String& item(unsigned idx) { return m_files[idx]; }
+
+private:
+    SerializedFileList(const FileList* list)
+    {
+        unsigned length = list->length();
+        m_files.reserveCapacity(length);
+        for (unsigned i = 0; i < length; i++)
+            m_files.append(list->item(i)->path().crossThreadString());
+    }
+
+    Vector<String> m_files;
+};
+
+class SerializedImageData : public SharedSerializedData {
+public:
+    static PassRefPtr<SerializedImageData> create(const ImageData* imageData)
+    {
+        return adoptRef(new SerializedImageData(imageData));
+    }
+    
+    unsigned width() const { return m_width; }
+    unsigned height() const { return m_height; }
+    WTF::ByteArray* data() const { return m_storage.get(); }
+private:
+    SerializedImageData(const ImageData* imageData)
+        : m_width(imageData->width())
+        , m_height(imageData->height())
+    {
+        WTF::ByteArray* array = imageData->data()->data();
+        m_storage = WTF::ByteArray::create(array->length());
+        memcpy(m_storage->data(), array->data(), array->length());
+    }
+    unsigned m_width;
+    unsigned m_height;
+    RefPtr<WTF::ByteArray> m_storage;
+};
+
 SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedObject> data)
     : m_type(ObjectType)
     , m_sharedData(data)
@@ -148,6 +204,24 @@ SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> dat
 {
 }
 
+SerializedScriptValueData::SerializedScriptValueData(const FileList* fileList)
+    : m_type(FileListType)
+    , m_sharedData(SerializedFileList::create(fileList))
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(const ImageData* imageData)
+    : m_type(ImageDataType)
+    , m_sharedData(SerializedImageData::create(imageData))
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(const File* file)
+    : m_type(FileType)
+    , m_string(file->path().crossThreadString())
+{
+}
+
 SerializedArray* SharedSerializedData::asArray()
 {
     return static_cast<SerializedArray*>(this);
@@ -158,6 +232,16 @@ SerializedObject* SharedSerializedData::asObject()
     return static_cast<SerializedObject*>(this);
 }
 
+SerializedFileList* SharedSerializedData::asFileList()
+{
+    return static_cast<SerializedFileList*>(this);
+}
+
+SerializedImageData* SharedSerializedData::asImageData()
+{
+    return static_cast<SerializedImageData*>(this);
+}
+
 static const unsigned maximumFilterRecursion = 40000;
 enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember,
     ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
@@ -470,7 +554,7 @@ struct SerializingTreeWalker : public BaseWalker {
             return SerializedScriptValueData(value);
 
         if (value.isString())
-            return SerializedScriptValueData(asString(value)->value());
+            return SerializedScriptValueData(asString(value)->value(m_exec));
 
         if (value.isNumber())
             return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
@@ -481,10 +565,19 @@ struct SerializingTreeWalker : public BaseWalker {
         if (isArray(value))
             return SerializedScriptValueData();
 
-        CallData unusedData;
-        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
-            return SerializedScriptValueData();
-
+        if (value.isObject()) {
+            JSObject* obj = asObject(value);
+            if (obj->inherits(&JSFile::s_info))
+                return SerializedScriptValueData(toFile(obj));
+            if (obj->inherits(&JSFileList::s_info))
+                return SerializedScriptValueData(toFileList(obj));
+            if (obj->inherits(&JSImageData::s_info))
+                return SerializedScriptValueData(toImageData(obj));
+                
+            CallData unusedData;
+            if (value.getCallData(unusedData) == CallTypeNone)
+                return SerializedScriptValueData();
+        }
         // Any other types are expected to serialize as null.
         return SerializedScriptValueData(jsNull());
     }
@@ -559,8 +652,10 @@ struct DeserializingTreeWalker : public BaseWalker {
     typedef JSObject* OutputObject;
     typedef SerializedObject::PropertyNameList PropertyList;
 
-    DeserializingTreeWalker(ExecState* exec, bool mustCopy)
+    DeserializingTreeWalker(ExecState* exec, JSGlobalObject* globalObject, bool mustCopy)
         : BaseWalker(exec)
+        , m_globalObject(globalObject)
+        , m_isDOMGlobalObject(globalObject->inherits(&JSDOMGlobalObject::s_info))
         , m_mustCopy(mustCopy)
     {
     }
@@ -589,14 +684,14 @@ struct DeserializingTreeWalker : public BaseWalker {
 
     JSArray* createOutputArray(unsigned length)
     {
-        JSArray* array = constructEmptyArray(m_exec);
+        JSArray* array = constructEmptyArray(m_exec, m_globalObject);
         array->setLength(length);
         return array;
     }
 
     JSObject* createOutputObject()
     {
-        return constructEmptyObject(m_exec);
+        return constructEmptyObject(m_exec, m_globalObject);
     }
 
     uint32_t length(RefPtr<SerializedArray> array)
@@ -639,11 +734,35 @@ struct DeserializingTreeWalker : public BaseWalker {
             case SerializedScriptValueData::NumberType:
                 return jsNumber(m_exec, value.asDouble());
             case SerializedScriptValueData::DateType:
-                return new (m_exec) DateInstance(m_exec, value.asDouble());
-            default:
+                return new (m_exec) DateInstance(m_exec, m_globalObject->dateStructure(), value.asDouble());
+            case SerializedScriptValueData::FileType:
+                if (!m_isDOMGlobalObject)
+                    return jsNull();
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), File::create(value.asString().crossThreadString()));
+            case SerializedScriptValueData::FileListType: {
+                if (!m_isDOMGlobalObject)
+                    return jsNull();
+                RefPtr<FileList> result = FileList::create();
+                SerializedFileList* serializedFileList = value.asFileList();
+                unsigned length = serializedFileList->length();
+                for (unsigned i = 0; i < length; i++)
+                    result->append(File::create(serializedFileList->item(i)));
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            }
+            case SerializedScriptValueData::ImageDataType: {
+                if (!m_isDOMGlobalObject)
+                    return jsNull();
+                SerializedImageData* serializedImageData = value.asImageData();
+                RefPtr<ImageData> result = ImageData::create(serializedImageData->width(), serializedImageData->height());
+                memcpy(result->data()->data()->data(), serializedImageData->data()->data(), serializedImageData->data()->length());
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            }
+            case SerializedScriptValueData::EmptyType:
                 ASSERT_NOT_REACHED();
-                return JSValue();
+                return jsNull();
         }
+        ASSERT_NOT_REACHED();
+        return jsNull();
     }
 
     void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
@@ -681,12 +800,15 @@ struct DeserializingTreeWalker : public BaseWalker {
     }
 
 private:
+    void* operator new(size_t);
+    JSGlobalObject* m_globalObject;
+    bool m_isDOMGlobalObject;
     bool m_mustCopy;
 };
 
-JSValue SerializedScriptValueData::deserialize(ExecState* exec, bool mustCopy) const
+JSValue SerializedScriptValueData::deserialize(ExecState* exec, JSGlobalObject* global, bool mustCopy) const
 {
-    DeserializingTreeWalker context(exec, mustCopy);
+    DeserializingTreeWalker context(exec, global, mustCopy);
     return walk<DeserializingTreeWalker>(context, *this);
 }
 
@@ -790,11 +912,15 @@ struct TeardownTreeWalker {
             case SerializedScriptValueData::StringType:
             case SerializedScriptValueData::ImmediateType:
             case SerializedScriptValueData::NumberType:
+            case SerializedScriptValueData::DateType:
+            case SerializedScriptValueData::EmptyType:
+            case SerializedScriptValueData::FileType:
+            case SerializedScriptValueData::FileListType:
+            case SerializedScriptValueData::ImageDataType:
                 return true;
-            default:
-                ASSERT_NOT_REACHED();
-                return JSValue();
         }
+        ASSERT_NOT_REACHED();
+        return true;
     }
 
     void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
@@ -836,4 +962,38 @@ void SerializedScriptValueData::tearDownSerializedData()
     walk<TeardownTreeWalker>(context, *this);
 }
 
+SerializedScriptValue::~SerializedScriptValue()
+{
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef originContext, JSValueRef apiValue, JSValueRef* exception)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = toJS(originContext);
+    JSValue value = toJS(exec, apiValue);
+    PassRefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(exec, value);
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    
+    return serializedValue;
+}
+
+JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, JSValueRef* exception)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = toJS(destinationContext);
+    JSValue value = deserialize(exec, exec->lexicalGlobalObject());
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    return toRef(exec, value);
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
index f8a126f..93bd0de 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
@@ -29,15 +29,25 @@
 
 #include "ScriptValue.h"
 
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef const struct OpaqueJSValue* JSValueRef;
+
 namespace WebCore {
-    class SerializedObject;
+    class File;
+    class FileList;
+    class ImageData;
     class SerializedArray;
+    class SerializedFileList;
+    class SerializedImageData;
+    class SerializedObject;
 
     class SharedSerializedData : public RefCounted<SharedSerializedData> {
     public:
         virtual ~SharedSerializedData() { }
         SerializedArray* asArray();
         SerializedObject* asObject();
+        SerializedFileList* asFileList();
+        SerializedImageData* asImageData();
     };
 
     class SerializedScriptValue;
@@ -51,12 +61,15 @@ namespace WebCore {
             ImmediateType,
             ObjectType,
             ArrayType,
-            StringType
+            StringType,
+            FileType,
+            FileListType,
+            ImageDataType
         };
 
         SerializedType type() const { return m_type; }
         static SerializedScriptValueData serialize(JSC::ExecState*, JSC::JSValue);
-        JSC::JSValue deserialize(JSC::ExecState*, bool mustCopy) const;
+        JSC::JSValue deserialize(JSC::ExecState*, JSC::JSGlobalObject*, bool mustCopy) const;
 
         ~SerializedScriptValueData()
         {
@@ -74,6 +87,10 @@ namespace WebCore {
             , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
         {
         }
+        
+        explicit SerializedScriptValueData(const File*);
+        explicit SerializedScriptValueData(const FileList*);
+        explicit SerializedScriptValueData(const ImageData*);
 
         explicit SerializedScriptValueData(JSC::JSValue value)
             : m_type(ImmediateType)
@@ -105,7 +122,7 @@ namespace WebCore {
 
         String asString() const
         {
-            ASSERT(m_type == StringType);
+            ASSERT(m_type == StringType || m_type == FileType);
             return m_string;
         }
 
@@ -123,6 +140,20 @@ namespace WebCore {
             return m_sharedData->asArray();
         }
 
+        SerializedFileList* asFileList() const
+        {
+            ASSERT(m_type == FileListType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asFileList();
+        }
+        
+        SerializedImageData* asImageData() const
+        {
+            ASSERT(m_type == ImageDataType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asImageData();
+        }
+
         operator bool() const { return m_type != EmptyType; }
 
         SerializedScriptValueData release()
@@ -150,6 +181,8 @@ namespace WebCore {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
         }
 
+        static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef value, JSValueRef* exception);
+
         static PassRefPtr<SerializedScriptValue> create(String string)
         {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
@@ -175,14 +208,15 @@ namespace WebCore {
             return m_value.asString();
         }
 
-        JSC::JSValue deserialize(JSC::ExecState* exec)
+        JSC::JSValue deserialize(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
         {
             if (!m_value)
                 return JSC::jsNull();
-            return m_value.deserialize(exec, m_mustCopy);
+            return m_value.deserialize(exec, globalObject, m_mustCopy);
         }
 
-        ~SerializedScriptValue() {}
+        JSValueRef deserialize(JSContextRef, JSValueRef* exception);
+        ~SerializedScriptValue();
 
     private:
         SerializedScriptValue(SerializedScriptValueData value)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WebCoreJSClientData.h b/src/3rdparty/webkit/WebCore/bindings/js/WebCoreJSClientData.h
new file mode 100644
index 0000000..e0d2e4e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WebCoreJSClientData.h
@@ -0,0 +1,78 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebCoreJSClientData_h
+#define WebCoreJSClientData_h
+
+#include "DOMWrapperWorld.h"
+#include "DOMObjectHashTableMap.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class WebCoreJSClientData : public JSC::JSGlobalData::ClientData, public Noncopyable {
+    friend class JSGlobalDataWorldIterator;
+public:
+    WebCoreJSClientData(JSC::JSGlobalData* globalData)
+        : m_normalWorld(DOMWrapperWorld::create(globalData, true))
+    {
+        m_worldSet.add(m_normalWorld.get());
+    }
+
+    virtual ~WebCoreJSClientData()
+    {
+        ASSERT(m_worldSet.contains(m_normalWorld.get()));
+        ASSERT(m_worldSet.size() == 1);
+        ASSERT(m_normalWorld->hasOneRef());
+        m_normalWorld.clear();
+        ASSERT(m_worldSet.isEmpty());
+    }
+
+    DOMWrapperWorld* normalWorld() { return m_normalWorld.get(); }
+
+    void getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
+    {
+        copyToVector(m_worldSet, worlds);
+    }
+
+    void rememberWorld(DOMWrapperWorld* world)
+    {
+        ASSERT(!m_worldSet.contains(world));
+        m_worldSet.add(world);
+    }
+    void forgetWorld(DOMWrapperWorld* world)
+    {
+        ASSERT(m_worldSet.contains(world));
+        m_worldSet.remove(world);
+    }
+
+    DOMObjectHashTableMap hashTableMap;
+
+private:
+    HashSet<DOMWrapperWorld*> m_worldSet;
+    RefPtr<DOMWrapperWorld> m_normalWorld;
+};
+
+} // namespace WebCore
+
+#endif // WebCoreJSClientData_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index b66b0e8..e371423 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -30,11 +30,11 @@
 
 #include "WorkerScriptController.h"
 
-#include "JSDOMBinding.h"
 #include "JSDedicatedWorkerContext.h"
 #include "JSSharedWorkerContext.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
+#include "WebCoreJSClientData.h"
 #include "WorkerContext.h"
 #include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
@@ -58,9 +58,6 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
 WorkerScriptController::~WorkerScriptController()
 {
     m_workerContextWrapper = 0; // Unprotect the global object.
-
-    ASSERT(!m_globalData->heap.protectedObjectCount());
-    ASSERT(!m_globalData->heap.isBusy());
     m_globalData->heap.destroy();
 }
 
@@ -123,7 +120,7 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
 
     ExecState* exec = m_workerContextWrapper->globalExec();
     m_workerContextWrapper->globalData()->timeoutChecker.start();
-    Completion comp = evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper, currentWorld(exec));
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
     m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)