Updated WebKit from /home/shausman/src/webkit/trunk to qtwebkit-4.6-snapshot-15062009 ( 65232bf00dc494ebfd978f998c88f58d18ecce1e )

155 files changed, 3846 insertions, 2917 deletions

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.cpp b/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.cpp
deleted file mode 100644
index 911da71..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.cpp
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
-#include "config.h"
-#include "DOMTimer.h"
-
-#include "Document.h"
-#include "ScheduledAction.h"
-#include "ScriptExecutionContext.h"
-#include <wtf/HashSet.h>
-#include <wtf/StdLibExtras.h>
-
-using namespace std;
-
-namespace WebCore {
-
-static const int maxTimerNestingLevel = 5;
-static const double oneMillisecond = 0.001;
-static const double minTimerInterval = 0.010; // 10 milliseconds
-
-static int timerNestingLevel = 0;
-
-DOMTimer::DOMTimer(ScriptExecutionContext* context, ScheduledAction* action, int timeout, bool singleShot)
-    : ActiveDOMObject(context, this)
-    , m_action(action)
-    , m_nextFireInterval(0)
-    , m_repeatInterval(0)
-{
-    static int lastUsedTimeoutId = 0;
-    ++lastUsedTimeoutId;
-    // Avoid wraparound going negative on us.
-    if (lastUsedTimeoutId <= 0)
-        lastUsedTimeoutId = 1;
-    m_timeoutId = lastUsedTimeoutId;
-    
-    m_nestingLevel = timerNestingLevel + 1;
-
-    // FIXME: Move the timeout map and API to ScriptExecutionContext to be able
-    // to create timeouts from Workers.
-    ASSERT(scriptExecutionContext() && scriptExecutionContext()->isDocument());
-    static_cast<Document*>(scriptExecutionContext())->addTimeout(m_timeoutId, this);
-
-    double intervalMilliseconds = max(oneMillisecond, timeout * oneMillisecond);
-
-    // Use a minimum interval of 10 ms to match other browsers, but only once we've
-    // nested enough to notice that we're repeating.
-    // Faster timers might be "better", but they're incompatible.
-    if (intervalMilliseconds < minTimerInterval && m_nestingLevel >= maxTimerNestingLevel)
-        intervalMilliseconds = minTimerInterval;
-    if (singleShot)
-        startOneShot(intervalMilliseconds);
-    else
-        startRepeating(intervalMilliseconds);
-}
-
-DOMTimer::~DOMTimer()
-{
-    if (scriptExecutionContext()) {
-        ASSERT(scriptExecutionContext()->isDocument());
-        static_cast<Document*>(scriptExecutionContext())->removeTimeout(m_timeoutId);
-    }
-}
-    
-int DOMTimer::install(ScriptExecutionContext* context, ScheduledAction* action, int timeout, bool singleShot)
-{
-    // DOMTimer constructor links the new timer into a list of ActiveDOMObjects held by the 'context'.
-    // The timer is deleted when context is deleted (DOMTimer::contextDestroyed) or explicitly via DOMTimer::removeById(),
-    // or if it is a one-time timer and it has fired (DOMTimer::fired).
-    DOMTimer* timer = new DOMTimer(context, action, timeout, singleShot);
-    return timer->m_timeoutId;
-}
-
-void DOMTimer::removeById(ScriptExecutionContext* context, int timeoutId)
-{
-    // timeout IDs have to be positive, and 0 and -1 are unsafe to
-    // even look up since they are the empty and deleted value
-    // respectively
-    if (timeoutId <= 0)
-        return;
-    ASSERT(context && context->isDocument());
-    delete static_cast<Document*>(context)->findTimeout(timeoutId);
-}
-
-void DOMTimer::fired()
-{
-    ScriptExecutionContext* context = scriptExecutionContext();
-    timerNestingLevel = m_nestingLevel;
-
-    // Simple case for non-one-shot timers.
-    if (isActive()) {
-        if (repeatInterval() && repeatInterval() < minTimerInterval) {
-            m_nestingLevel++;
-            if (m_nestingLevel >= maxTimerNestingLevel)
-                augmentRepeatInterval(minTimerInterval - repeatInterval());
-        }
-        
-        // No access to member variables after this point, it can delete the timer.
-        m_action->execute(context);
-        return;
-    }
-
-    // Delete timer before executing the action for one-shot timers.
-    ScheduledAction* action = m_action.release();
-
-    // No access to member variables after this point.
-    delete this;
-    
-    action->execute(context);
-    delete action;
-    timerNestingLevel = 0;
-}
-
-bool DOMTimer::hasPendingActivity() const
-{
-    return isActive();
-}
-
-void DOMTimer::contextDestroyed()
-{
-    ActiveDOMObject::contextDestroyed();
-    delete this;
-}
-
-void DOMTimer::stop()
-{
-    TimerBase::stop();
-    // Need to release JS objects potentially protected by ScheduledAction
-    // because they can form circular references back to the ScriptExecutionContext
-    // which will cause a memory leak.
-    m_action.clear();
-}
-
-void DOMTimer::suspend() 
-{ 
-    ASSERT(m_nextFireInterval == 0 && m_repeatInterval == 0); 
-    m_nextFireInterval = nextFireInterval();
-    m_repeatInterval = repeatInterval();
-    TimerBase::stop();
-} 
- 
-void DOMTimer::resume() 
-{ 
-    start(m_nextFireInterval, m_repeatInterval);
-    m_nextFireInterval = 0;
-    m_repeatInterval = 0;
-} 
- 
- 
-bool DOMTimer::canSuspend() const 
-{ 
-    return true;
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
index ceb7928..db295c2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
@@ -65,7 +65,7 @@ GCController::GCController()
 void GCController::garbageCollectSoon()
 {
     if (!m_GCTimer.isActive())
-        m_GCTimer.startOneShot(0);
+        m_GCTimer.startOneShot(0.5);
 }
 
 void GCController::gcTimerFired(Timer<GCController>*)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index a97d039..4f3c8ee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -40,14 +40,14 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-void JSAttr::setValue(ExecState* exec, JSValuePtr value)
+void JSAttr::setValue(ExecState* exec, JSValue value)
 {
     Attr* imp = static_cast<Attr*>(impl());
     String attrValue = valueToStringWithNullCheck(exec, value);
 
     Element* ownerElement = imp->ownerElement();
     if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
-        if (equalIgnoringCase(imp->name(), "src") && protocolIs(parseURL(attrValue), "javascript")) {
+        if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(parseURL(attrValue))) {
             if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
                 return;
         }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
index eed5b2e..74bcad5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -41,22 +41,33 @@ namespace WebCore {
 
 const ClassInfo JSAudioConstructor::s_info = { "AudioConstructor", 0, 0, 0 };
 
-JSAudioConstructor::JSAudioConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSAudioConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
 
+    putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
 }
 
+Document* JSAudioConstructor::document() const
+{
+    return static_cast<Document*>(m_globalObject->scriptExecutionContext());
+}
+
 static JSObject* constructAudio(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
     // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
 
-    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, static_cast<JSAudioConstructor*>(constructor)->document());
+    Document* document = static_cast<JSAudioConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Audio constructor associated document is unavailable");
+
+    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
     if (args.size() > 0) {
-        audio->setSrc(args.at(exec, 0)->toString(exec));
+        audio->setSrc(args.at(0).toString(exec));
         audio->scheduleLoad();
     }
     return asObject(toJS(exec, audio.release()));
@@ -71,8 +82,8 @@ ConstructType JSAudioConstructor::getConstructData(ConstructData& constructData)
 void JSAudioConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h
index cdff10f..0a3a7ea 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h
@@ -36,9 +36,9 @@ namespace WebCore {
 
     class JSAudioConstructor : public DOMObject {
     public:
-        JSAudioConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSAudioConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        Document* document() const { return m_document->impl(); }
+        Document* document() const;
 
         static const JSC::ClassInfo s_info;
 
@@ -48,7 +48,7 @@ namespace WebCore {
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDocument* m_document;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCDATASectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCDATASectionCustom.cpp
new file mode 100644
index 0000000..44a8957
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCDATASectionCustom.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCDATASection.h"
+
+#include "CDATASection.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue toJSNewlyCreated(ExecState* exec, CDATASection* section)
+{
+    if (!section)
+        return jsNull();
+    
+    return CREATE_DOM_NODE_WRAPPER(exec, CDATASection, section);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 32462fa..2c20431 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -49,7 +49,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, CSSRule* rule)
+JSValue toJS(ExecState* exec, CSSRule* rule)
 {
     if (!rule)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 6c46ae4..b07f201 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -77,7 +77,7 @@ static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPo
         return String();
 
     Vector<UChar> name;
-    name.reserveCapacity(length);
+    name.reserveInitialCapacity(length);
 
     unsigned i = 0;
 
@@ -127,7 +127,7 @@ bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*,
 
 // FIXME: You can get these properties, and set them (see customPut below),
 // but you should also be able to enumerate them.
-JSValuePtr JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
 
@@ -156,7 +156,7 @@ JSValuePtr JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier&
 }
 
 
-bool JSCSSStyleDeclaration::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+bool JSCSSStyleDeclaration::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     if (!isCSSPropertyName(propertyName))
         return false;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
index 9e31304..ad0cee1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, CSSValue* value)
+JSValue toJS(ExecState* exec, CSSValue* value)
 {
     if (!value)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 6eb4fc5..76db871 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -40,7 +40,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValuePtr toJS(ExecState* exec, CanvasStyle* style)
+static JSValue toJS(ExecState* exec, CanvasStyle* style)
 {
     if (style->canvasGradient())
         return toJS(exec, style->canvasGradient());
@@ -49,11 +49,11 @@ static JSValuePtr toJS(ExecState* exec, CanvasStyle* style)
     return jsString(exec, style->color());
 }
 
-static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValuePtr value)
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
 {
-    if (value->isString())
+    if (value.isString())
         return CanvasStyle::create(asString(value)->value());
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
     if (object->inherits(&JSCanvasGradient::s_info))
@@ -63,27 +63,27 @@ static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValuePtr value)
     return 0;
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
+JSValue JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
 {
     return toJS(exec, impl()->strokeStyle());        
 }
 
-void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValuePtr value)
+void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue value)
 {
     impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
 }
 
-JSValuePtr JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
+JSValue JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
 {
     return toJS(exec, impl()->fillStyle());
 }
 
-void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValuePtr value)
+void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue value)
 {
     impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
 }
 
-JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
 {
     CanvasRenderingContext2D* context = impl();
 
@@ -95,24 +95,24 @@ JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgLi
     // 5 args = c, m, y, k, a
     switch (args.size()) {
         case 1:
-            if (args.at(exec, 0)->isString())
-                context->setFillColor(asString(args.at(exec, 0))->value());
+            if (args.at(0).isString())
+                context->setFillColor(asString(args.at(0))->value());
             else
-                context->setFillColor(args.at(exec, 0)->toFloat(exec));
+                context->setFillColor(args.at(0).toFloat(exec));
             break;
         case 2:
-            if (args.at(exec, 0)->isString())
-                context->setFillColor(asString(args.at(exec, 0))->value(), args.at(exec, 1)->toFloat(exec));
+            if (args.at(0).isString())
+                context->setFillColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
             else
-                context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec));
+                context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
         case 4:
-            context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                  args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+            context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                  args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                  args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+            context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                  args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -120,7 +120,7 @@ JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgLi
     return jsUndefined();
 }    
 
-JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -132,24 +132,24 @@ JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const Arg
     // 5 args = c, m, y, k, a
     switch (args.size()) {
         case 1:
-            if (args.at(exec, 0)->isString())
-                context->setStrokeColor(asString(args.at(exec, 0))->value());
+            if (args.at(0).isString())
+                context->setStrokeColor(asString(args.at(0))->value());
             else
-                context->setStrokeColor(args.at(exec, 0)->toFloat(exec));
+                context->setStrokeColor(args.at(0).toFloat(exec));
             break;
         case 2:
-            if (args.at(exec, 0)->isString())
-                context->setStrokeColor(asString(args.at(exec, 0))->value(), args.at(exec, 1)->toFloat(exec));
+            if (args.at(0).isString())
+                context->setStrokeColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
             else
-                context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec));
+                context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
         case 4:
-            context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                    args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+            context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                    args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+            context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -158,21 +158,21 @@ JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const Arg
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
     
     if (args.size() <= 4)
-        context->strokeRect(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                            args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+        context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                            args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->strokeRect(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                            args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+        context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                            args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
 
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -182,8 +182,8 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
     //     drawImage(img, sx, sy, sw, sh, dx, dy, dw, dh)
     // Composite operation is specified with globalCompositeOperation.
     // The img parameter can be a <img> or <canvas> element.
-    JSValuePtr value = args.at(exec, 0);
-    if (!value->isObject())
+    JSValue value = args.at(0);
+    if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
     
@@ -192,18 +192,18 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
         HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
         switch (args.size()) {
             case 3:
-                context->drawImage(imgElt, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+                context->drawImage(imgElt, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
                 break;
             case 5:
-                context->drawImage(imgElt, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), ec);
+                context->drawImage(imgElt, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
                 setDOMException(exec, ec);
                 break;
             case 9:
-                context->drawImage(imgElt, FloatRect(args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec)),
-                                   FloatRect(args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
-                                   args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec)), ec);
+                context->drawImage(imgElt, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                   FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                   args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
                 setDOMException(exec, ec);
                 break;
             default:
@@ -213,18 +213,18 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
         HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
         switch (args.size()) {
             case 3:
-                context->drawImage(canvas, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+                context->drawImage(canvas, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
                 break;
             case 5:
-                context->drawImage(canvas, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), ec);
+                context->drawImage(canvas, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
                 setDOMException(exec, ec);
                 break;
             case 9:
-                context->drawImage(canvas, FloatRect(args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec)),
-                                   FloatRect(args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
-                                   args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec)), ec);
+                context->drawImage(canvas, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                   FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                   args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
                 setDOMException(exec, ec);
                 break;
             default:
@@ -237,64 +237,64 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
     
-    JSValuePtr value = args.at(exec, 0);
-    if (!value->isObject())
+    JSValue value = args.at(0);
+    if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
     
     if (!o->inherits(&JSHTMLImageElement::s_info))
         return throwError(exec, TypeError);
     context->drawImageFromRect(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                               args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                               args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec),
-                               args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
-                               args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec),
-                               args.at(exec, 9)->toString(exec));    
+                               args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                               args.at(3).toFloat(exec), args.at(4).toFloat(exec),
+                               args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                               args.at(7).toFloat(exec), args.at(8).toFloat(exec),
+                               args.at(9).toString(exec));    
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
     switch (args.size()) {
         case 3:
-            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                               args.at(exec, 2)->toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec));
             break;
         case 4:
-            if (args.at(exec, 3)->isString())
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), asString(args.at(exec, 3))->value());
+            if (args.at(3).isString())
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value());
             else
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            if (args.at(exec, 3)->isString())
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), asString(args.at(exec, 3))->value(),
-                                   args.at(exec, 4)->toFloat(exec));
+            if (args.at(3).isString())
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(),
+                                   args.at(4).toFloat(exec));
             else
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
-                                   args.at(exec, 4)->toFloat(exec));
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                                   args.at(4).toFloat(exec));
             break;
         case 7:
-            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                               args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
-                               args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec),
-                               args.at(exec, 6)->toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                               args.at(4).toFloat(exec), args.at(5).toFloat(exec),
+                               args.at(6).toFloat(exec));
             break;
         case 8:
-            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                               args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
-                               args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec),
-                               args.at(exec, 6)->toFloat(exec), args.at(exec, 7)->toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                               args.at(4).toFloat(exec), args.at(5).toFloat(exec),
+                               args.at(6).toFloat(exec), args.at(7).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -303,28 +303,28 @@ JSValuePtr JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList&
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
-    JSValuePtr value = args.at(exec, 0);
-    if (!value->isObject())
+    JSValue value = args.at(0);
+    if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
 
     if (o->inherits(&JSHTMLImageElement::s_info)) {
         ExceptionCode ec;
-        JSValuePtr pattern = toJS(exec,
+        JSValue pattern = toJS(exec,
             context->createPattern(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                                   valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+                                   valueToStringWithNullCheck(exec, args.at(1)), ec).get());
         setDOMException(exec, ec);
         return pattern;
     }
     if (o->inherits(&JSHTMLCanvasElement::s_info)) {
         ExceptionCode ec;
-        JSValuePtr pattern = toJS(exec,
+        JSValue pattern = toJS(exec,
             context->createPattern(static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+                valueToStringWithNullCheck(exec, args.at(1)), ec).get());
         setDOMException(exec, ec);
         return pattern;
     }
@@ -332,7 +332,7 @@ JSValuePtr JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgL
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList& args)
 {
     // putImageData has two variants
     // putImageData(ImageData, x, y)
@@ -341,16 +341,16 @@ JSValuePtr JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgLi
 
     ExceptionCode ec = 0;
     if (args.size() >= 7)
-        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), 
-                              args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec), ec);
+        context->putImageData(toImageData(args.at(0)), args.at(1).toFloat(exec), args.at(2).toFloat(exec), 
+                              args.at(3).toFloat(exec), args.at(4).toFloat(exec), args.at(5).toFloat(exec), args.at(6).toFloat(exec), ec);
     else
-        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), ec);
+        context->putImageData(toImageData(args.at(0)), args.at(1).toFloat(exec), args.at(2).toFloat(exec), ec);
 
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -362,13 +362,13 @@ JSValuePtr JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList&
         return throwError(exec, SyntaxError);
     
     if (args.size() == 4)
-        context->fillText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+        context->fillText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->fillText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+        context->fillText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -380,9 +380,9 @@ JSValuePtr JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList
         return throwError(exec, SyntaxError);
     
     if (args.size() == 4)
-        context->strokeText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+        context->strokeText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->strokeText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+        context->strokeText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
index 8ffb49e..78dca49 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -48,7 +48,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-JSValuePtr JSClipboard::types(ExecState* exec) const
+JSValue JSClipboard::types(ExecState* exec) const
 {
     Clipboard* clipboard = impl();
 
@@ -56,14 +56,14 @@ JSValuePtr JSClipboard::types(ExecState* exec) const
     if (types.isEmpty())
         return jsNull();
 
-    ArgList list;
+    MarkedArgumentBuffer list;
     HashSet<String>::const_iterator end = types.end();
     for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
         list.append(jsString(exec, UString(*it)));
     return constructArray(exec, list);
 }
 
-JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::clearData(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -73,7 +73,7 @@ JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
     }
 
     if (args.size() == 1) {
-        clipboard->clearData(args.at(exec, 0)->toString(exec));
+        clipboard->clearData(args.at(0).toString(exec));
         return jsUndefined();
     }
 
@@ -81,7 +81,7 @@ JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
     return throwError(exec, SyntaxError, "clearData: Invalid number of arguments");
 }
 
-JSValuePtr JSClipboard::getData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::getData(ExecState* exec, const ArgList& args)
 {
     // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments.
     if (args.size() != 1)
@@ -90,14 +90,14 @@ JSValuePtr JSClipboard::getData(ExecState* exec, const ArgList& args)
     Clipboard* clipboard = impl();
 
     bool success;
-    String result = clipboard->getData(args.at(exec, 0)->toString(exec), success);
+    String result = clipboard->getData(args.at(0).toString(exec), success);
     if (!success)
         return jsUndefined();
 
     return jsString(exec, result);
 }
 
-JSValuePtr JSClipboard::setData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::setData(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -105,10 +105,10 @@ JSValuePtr JSClipboard::setData(ExecState* exec, const ArgList& args)
     if (args.size() != 2)
         return throwError(exec, SyntaxError, "setData: Invalid number of arguments");
 
-    return jsBoolean(clipboard->setData(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toString(exec)));
+    return jsBoolean(clipboard->setData(args.at(0).toString(exec), args.at(1).toString(exec)));
 }
 
-JSValuePtr JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -119,11 +119,11 @@ JSValuePtr JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
     if (args.size() != 3)
         return throwError(exec, SyntaxError, "setDragImage: Invalid number of arguments");
 
-    int x = args.at(exec, 1)->toInt32(exec);
-    int y = args.at(exec, 2)->toInt32(exec);
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
 
     // See if they passed us a node
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
     if (!node)
         return throwError(exec, TypeError);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
index ddfe4f7..9c48467 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -34,12 +34,14 @@ using namespace JSC;
 
 namespace WebCore {
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 typedef Vector<RefPtr<JSC::Profile> > ProfilesArray;
 
-JSValuePtr JSConsole::profiles(ExecState* exec) const
+JSValue JSConsole::profiles(ExecState* exec) const
 {
     const ProfilesArray& profiles = impl()->profiles();
-    ArgList list;
+    MarkedArgumentBuffer list;
 
     ProfilesArray::const_iterator end = profiles.end();
     for (ProfilesArray::const_iterator iter = profiles.begin(); iter != end; ++iter)
@@ -48,4 +50,6 @@ JSValuePtr JSConsole::profiles(ExecState* exec) const
     return constructArray(exec, list);
 }
 
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCoordinatesCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCoordinatesCustom.cpp
new file mode 100644
index 0000000..720bb9b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCoordinatesCustom.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCoordinates.h"
+
+#include "Coordinates.h"
+
+using namespace JSC;
+
+namespace WebCore {
+    
+JSValue JSCoordinates::altitude(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideAltitude())
+        return jsNull();
+    return jsNumber(exec, imp->altitude());
+}
+
+JSValue JSCoordinates::altitudeAccuracy(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideAltitudeAccuracy())
+        return jsNull();
+    return jsNumber(exec, imp->altitudeAccuracy());
+}
+
+JSValue JSCoordinates::heading(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideHeading())
+        return jsNull();
+    return jsNumber(exec, imp->heading());
+}
+
+JSValue JSCoordinates::speed(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideSpeed())
+        return jsNull();
+    return jsNumber(exec, imp->speed());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index 836ffb9..6f9efd9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -26,10 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionCallback.h"
 
-#include "CString.h"
 #include "Frame.h"
 #include "JSGeoposition.h"
-#include "Page.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -56,9 +54,9 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raise
     
     JSC::JSLock lock(false);
     
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -70,17 +68,19 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raise
     
     RefPtr<JSCustomPositionCallback> protect(this);
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, geoposition));
     
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
     
     if (exec->hadException()) {
         reportCurrentException(exec);
         raisedException = true;
     }
+    
+    Document::updateStyleForAllDocuments();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index b4e9535..cc6cd55 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -26,10 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionErrorCallback.h"
 
-#include "CString.h"
 #include "Frame.h"
 #include "JSPositionError.h"
-#include "Page.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -56,9 +54,9 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
     
     JSC::JSLock lock(false);
     
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -70,15 +68,17 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
     
     RefPtr<JSCustomPositionErrorCallback> protect(this);
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, positionError));
     
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
     
     if (exec->hadException())
         reportCurrentException(exec);
+    
+    Document::updateStyleForAllDocuments();
 }
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index 2243564..107a491 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -28,9 +28,8 @@
 
 #include "config.h"
 #include "JSCustomSQLStatementCallback.h"
+#if ENABLE(DATABASE)
 
-#include "CString.h"
-#include "DOMWindow.h"
 #include "Frame.h"
 #include "ScriptController.h"
 #include "JSSQLResultSet.h"
@@ -60,9 +59,9 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
         
     JSC::JSLock lock(false);
 
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -74,13 +73,13 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
 
     RefPtr<JSCustomSQLStatementCallback> protect(this);
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
     args.append(toJS(exec, resultSet));
         
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException()) {
         reportCurrentException(exec);
@@ -88,7 +87,9 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
         raisedException = true;
     }
 
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index 3a3ae21..c380670 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLStatementCallback_h
 #define JSCustomSQLStatementCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLStatementCallback.h"
 
 #include <runtime/JSObject.h>
@@ -59,4 +61,6 @@ private:
 
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // JSCustomSQLStatementCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 14080ea..018dabd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "JSCustomSQLStatementErrorCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
+#if ENABLE(DATABASE)
+
 #include "Frame.h"
 #include "ScriptController.h"
 #include "JSSQLError.h"
@@ -60,9 +60,9 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         
     JSC::JSLock lock(false);
         
-    JSValuePtr handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction->getCallData(handleEventCallData);
+    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
     CallData callbackCallData;
     CallType callbackCallType = CallTypeNone;
 
@@ -76,17 +76,17 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         
     RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
     args.append(toJS(exec, error));
         
-    JSValuePtr result;
-    globalObject->startTimeoutCheck();
+    JSValue result;
+    globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
     else
         result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException()) {
         reportCurrentException(exec);
@@ -98,9 +98,11 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         return true;
     }
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 
-    return result->toBoolean(exec);
+    return result.toBoolean(exec);
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index 2847114..e563393 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLStatementErrorCallback_h
 #define JSCustomSQLStatementErrorCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLStatementErrorCallback.h"
 
 #include <runtime/JSObject.h>
@@ -59,5 +61,7 @@ private:
     
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // JSCustomSQLStatementErrorCallback_h
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index 7910a88..a41ac78 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -29,10 +29,9 @@
 #include "config.h"
 #include "JSCustomSQLTransactionCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
+#if ENABLE(DATABASE)
+
 #include "Frame.h"
-#include "Logging.h"
 #include "ScriptController.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
@@ -101,9 +100,9 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
         
     JSC::JSLock lock(false);
         
-    JSValuePtr handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
     CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction->getCallData(handleEventCallData);
+    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
     CallData callbackCallData;
     CallType callbackCallType = CallTypeNone;
 
@@ -117,15 +116,15 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
         
     RefPtr<JSCustomSQLTransactionCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
 
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
     else
         call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException()) {
         reportCurrentException(exec);
@@ -133,7 +132,9 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
         raisedException = true;
     }
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
     
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index 0a21c1a..22c367c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLTransactionCallback_h
 #define JSCustomSQLTransactionCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLTransactionCallback.h"
 
 #include <wtf/PassRefPtr.h>
@@ -60,4 +62,6 @@ private:
 
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // JSCustomSQLTransactionCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index 7f95d4c..324e2bb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "JSCustomSQLTransactionErrorCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
+#if ENABLE(DATABASE)
+
 #include "Frame.h"
 #include "ScriptController.h"
 #include "JSSQLError.h"
@@ -46,47 +46,46 @@ JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObjec
 {
 }
     
-bool JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
 {
     ASSERT(m_callback);
     ASSERT(m_frame);
-        
+
     if (!m_frame->script()->isEnabled())
-        return true;
-        
+        return;
+
     JSGlobalObject* globalObject = m_frame->script()->globalObject();
     ExecState* exec = globalObject->globalExec();
-        
+
     JSC::JSLock lock(false);
-        
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
             // FIXME: Should an exception be thrown here?
-            return true;
+            return;
         }
         function = m_callback;
     }
 
     RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
-        
-    ArgList args;
+
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, error));
 
-    JSValuePtr result;
-    globalObject->startTimeoutCheck();
-    result = call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
-        
+    globalObject->globalData()->timeoutChecker.start();
+    call(exec, function, callType, callData, m_callback, args);
+    globalObject->globalData()->timeoutChecker.stop();
+
     if (exec->hadException())
         reportCurrentException(exec);
-        
-    Document::updateDocumentsRendering();
-    
-    return result->toBoolean(exec);
+
+    Document::updateStyleForAllDocuments();
 }
-    
+
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index 122224f..be3df29 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLTransactionErrorCallback_h
 #define JSCustomSQLTransactionErrorCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLTransactionErrorCallback.h"
 
 #include <runtime/JSObject.h>
@@ -48,7 +50,7 @@ class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
     static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
     
-    virtual bool handleEvent(SQLError*);
+    virtual void handleEvent(SQLError*);
 
 private:
     JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
@@ -58,5 +60,6 @@ private:
 };
 
 }
+#endif // ENABLE(DATABASE)
 
 #endif // JSCustomSQLTransactionErrorCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
index 527fa41..f3f76c4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -29,11 +29,8 @@
 #include "config.h"
 #include "JSCustomVoidCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
 #include "Frame.h"
 #include "JSDOMWindowCustom.h"
-#include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -60,9 +57,9 @@ void JSCustomVoidCallback::handleEvent()
         
     JSC::JSLock lock(false);
         
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -74,21 +71,21 @@ void JSCustomVoidCallback::handleEvent()
         
     RefPtr<JSCustomVoidCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException())
         reportCurrentException(exec);
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
  
-PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValuePtr value)
+PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue value)
 {
-    JSObject* object = value->getObject();
+    JSObject* object = value.getObject();
     if (!object)
         return 0;
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
index f54ddb6..9cd7c34 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -55,7 +55,7 @@ namespace WebCore {
         RefPtr<Frame> m_frame;
     };
 
-    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValuePtr);
+    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 8451dd0..6361e70 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -28,14 +28,10 @@
 
 #if ENABLE(XPATH)
 
-#include "CString.h"
-#include "Console.h"
-#include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "JSDOMWindowCustom.h"
-#include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -43,12 +39,12 @@ namespace WebCore {
 
 using namespace JSC;
 
-PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValuePtr value)
+PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValue value)
 {
-    if (value->isUndefinedOrNull())
+    if (value.isUndefinedOrNull())
         return 0;
 
-    JSObject* resolverObject = value->getObject();
+    JSObject* resolverObject = value.getObject();
     if (!resolverObject) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
@@ -81,9 +77,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     JSGlobalObject* globalObject = m_frame->script()->globalObject();
     ExecState* exec = globalObject->globalExec();
         
-    JSValuePtr function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
+    JSValue function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_customResolver->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -96,22 +92,22 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 
     RefPtr<JSCustomXPathNSResolver> selfProtector(this);
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
-    globalObject->startTimeoutCheck();
-    JSValuePtr retval = call(exec, function, callType, callData, m_customResolver, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
+    JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
+    globalObject->globalData()->timeoutChecker.stop();
 
     String result;
     if (exec->hadException())
         reportCurrentException(exec);
     else {
-        if (!retval->isUndefinedOrNull())
-            result = retval->toString(exec);
+        if (!retval.isUndefinedOrNull())
+            result = retval.toString(exec);
     }
 
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
index fecbb61..44c44f9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -44,7 +44,7 @@ namespace WebCore {
 
     class JSCustomXPathNSResolver : public XPathNSResolver {
     public:
-        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValuePtr);
+        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValue);
         
         virtual ~JSCustomXPathNSResolver();
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 5e867a1..7e8d9ce 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,44 +46,32 @@ void JSDOMApplicationCache::mark()
 {
     DOMObject::mark();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onchecking()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onnoupdate()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->ondownloading()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onupdateready()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->oncached()))
-        listener->mark();
+    markIfNotNull(m_impl->onchecking());
+    markIfNotNull(m_impl->onerror());
+    markIfNotNull(m_impl->onnoupdate());
+    markIfNotNull(m_impl->ondownloading());
+    markIfNotNull(m_impl->onprogress());
+    markIfNotNull(m_impl->onupdateready());
+    markIfNotNull(m_impl->oncached());
+    markIfNotNull(m_impl->onobsolete());
 
     typedef DOMApplicationCache::EventListenersMap EventListenersMap;
     typedef DOMApplicationCache::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
+#if ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
+
+JSValue JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
 
     ExceptionCode ec = 0;
     bool result = impl()->hasItem(url, ec);
@@ -91,12 +79,12 @@ JSValuePtr JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
     return jsBoolean(result);
 }
 
-JSValuePtr JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
     
     ExceptionCode ec = 0;
     impl()->add(url, ec);
@@ -104,12 +92,12 @@ JSValuePtr JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
     
     ExceptionCode ec = 0;
     impl()->remove(url, ec);
@@ -117,27 +105,29 @@ JSValuePtr JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
+#endif // ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
+
+JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 4cf083a..4f58797 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
  *
  *  This library is free software; you can redistribute it and/or
@@ -33,6 +33,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLImageElement.h"
+#include "HTMLScriptElement.h"
 #include "HTMLNames.h"
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
@@ -259,32 +260,47 @@ void forgetAllDOMNodesForDocument(Document* document)
     removeWrappers(document->wrapperCache());
 }
 
+static inline bool isObservableThroughDOM(JSNode* jsNode)
+{
+    // Certain conditions implicitly make a JS DOM node wrapper observable
+    // through the DOM, even if no explicit reference to it remains.
+
+    Node* node = jsNode->impl();
+
+    if (node->inDocument()) {
+        // 1. If a node is in the document, and its wrapper has custom properties,
+        // the wrapper is observable because future access to the node through the
+        // DOM must reflect those properties.
+        if (jsNode->hasCustomProperties())
+            return true;
+
+        // 2. If a node is in the document, and has event listeners, its wrapper is
+        // observable because its wrapper is responsible for marking those event listeners.
+        if (node->eventListeners().size())
+            return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
+    } else {
+        // 3. If a wrapper is the last reference to an image or script element
+        // that is loading but not in the document, the wrapper is observable
+        // because it is the only thing keeping the image element alive, and if
+        // the image element is destroyed, its load event will not fire.
+        // FIXME: The DOM should manage this issue without the help of JavaScript wrappers.
+        if (node->hasTagName(imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
+            return true;
+        if (node->hasTagName(scriptTag) && !static_cast<HTMLScriptElement*>(node)->haveFiredLoadEvent())
+            return true;
+    }
+
+    return false;
+}
+
 void markDOMNodesForDocument(Document* doc)
 {
-    // If a node's JS wrapper holds custom properties, those properties must
-    // persist every time the node is fetched from the DOM. So, we keep JS
-    // wrappers like that from being garbage collected.
-
     JSWrapperCache& nodeDict = doc->wrapperCache();
     JSWrapperCache::iterator nodeEnd = nodeDict.end();
     for (JSWrapperCache::iterator nodeIt = nodeDict.begin(); nodeIt != nodeEnd; ++nodeIt) {
         JSNode* jsNode = nodeIt->second;
-        Node* node = jsNode->impl();
-
-        if (jsNode->marked())
-            continue;
-
-        // No need to preserve a wrapper that has no custom properties or is no
-        // longer fetchable through the DOM.
-        if (!jsNode->hasCustomProperties() || !node->inDocument()) {
-            //... unless the wrapper wraps a loading image, since the "new Image"
-            // syntax allows an orphan image wrapper to be the last reference
-            // to a loading image, whose load event might have important side-effects.
-            if (!node->hasTagName(imgTag) || static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
-                continue;
-        }
-
-        jsNode->mark();
+        if (!jsNode->marked() && isObservableThroughDOM(jsNode))
+            jsNode->mark();
     }
 }
 
@@ -340,84 +356,91 @@ void markDOMObjectWrapper(JSGlobalData& globalData, void* object)
     wrapper->mark();
 }
 
-JSValuePtr jsStringOrNull(ExecState* exec, const String& s)
+JSValue jsStringOrNull(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsNull();
     return jsString(exec, s);
 }
 
-JSValuePtr jsOwnedStringOrNull(ExecState* exec, const UString& s)
+JSValue jsOwnedStringOrNull(ExecState* exec, const UString& s)
 {
     if (s.isNull())
         return jsNull();
     return jsOwnedString(exec, s);
 }
 
-JSValuePtr jsStringOrUndefined(ExecState* exec, const String& s)
+JSValue jsStringOrUndefined(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsUndefined();
     return jsString(exec, s);
 }
 
-JSValuePtr jsStringOrFalse(ExecState* exec, const String& s)
+JSValue jsStringOrFalse(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsBoolean(false);
     return jsString(exec, s);
 }
 
-JSValuePtr jsStringOrNull(ExecState* exec, const KURL& url)
+JSValue jsStringOrNull(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsNull();
     return jsString(exec, url.string());
 }
 
-JSValuePtr jsStringOrUndefined(ExecState* exec, const KURL& url)
+JSValue jsStringOrUndefined(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsUndefined();
     return jsString(exec, url.string());
 }
 
-JSValuePtr jsStringOrFalse(ExecState* exec, const KURL& url)
+JSValue jsStringOrFalse(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsBoolean(false);
     return jsString(exec, url.string());
 }
 
-UString valueToStringWithNullCheck(ExecState* exec, JSValuePtr value)
+UString valueToStringWithNullCheck(ExecState* exec, JSValue value)
 {
-    if (value->isNull())
+    if (value.isNull())
         return UString();
-    return value->toString(exec);
+    return value.toString(exec);
 }
 
-UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValuePtr value)
+UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValue value)
 {
-    if (value->isUndefinedOrNull())
+    if (value.isUndefinedOrNull())
         return UString();
-    return value->toString(exec);
+    return value.toString(exec);
 }
 
-void reportException(JSC::ExecState* exec, JSValuePtr exception)
+void reportException(ExecState* exec, JSValue exception)
 {
-    UString errorMessage = exception->toString(exec);
-    JSObject* exceptionObject = exception->toObject(exec);
-    int lineNumber = exceptionObject->get(exec, Identifier(exec, "line"))->toInt32(exec);
-    UString exceptionSourceURL = exceptionObject->get(exec, Identifier(exec, "sourceURL"))->toString(exec);
+    UString errorMessage = exception.toString(exec);
+    JSObject* exceptionObject = exception.toObject(exec);
+    int lineNumber = exceptionObject->get(exec, Identifier(exec, "line")).toInt32(exec);
+    UString exceptionSourceURL = exceptionObject->get(exec, Identifier(exec, "sourceURL")).toString(exec);
     exec->clearException();
 
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    ASSERT(scriptExecutionContext);
+
+    // Crash data indicates null-dereference crashes at this point in the Safari 4 Public Beta.
+    // It's harmless to return here without reporting the exception to the log and the debugger in this case.
+    if (!scriptExecutionContext)
+        return;
+
     scriptExecutionContext->reportException(errorMessage, lineNumber, exceptionSourceURL);
 }
 
-void reportCurrentException(JSC::ExecState* exec)
+void reportCurrentException(ExecState* exec)
 {
-    JSValuePtr exception = exec->exception();
+    JSValue exception = exec->exception();
     exec->clearException();
     reportException(exec, exception);
 }
@@ -430,7 +453,7 @@ void setDOMException(ExecState* exec, ExceptionCode ec)
     ExceptionCodeDescription description;
     getExceptionCodeDescription(ec, description);
 
-    JSValuePtr errorObject = noValue();
+    JSValue errorObject;
     switch (description.type) {
         case DOMExceptionType:
             errorObject = toJS(exec, DOMCoreException::create(description));
@@ -481,6 +504,12 @@ bool allowsAccessFromFrame(ExecState* exec, Frame* frame, String& message)
     return window && window->allowsAccessFrom(exec, message);
 }
 
+bool shouldAllowNavigation(ExecState* exec, Frame* frame)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    return lexicalFrame && lexicalFrame->loader()->shouldAllowNavigation(frame);
+}
+
 void printErrorMessageForFrame(Frame* frame, const String& message)
 {
     if (!frame)
@@ -489,39 +518,59 @@ void printErrorMessageForFrame(Frame* frame, const String& message)
         window->printErrorMessage(message);
 }
 
-JSValuePtr objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+Frame* toLexicalFrame(ExecState* exec)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, objectProtoFuncToString);
+    return asJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
 }
 
-ScriptState* scriptStateFromNode(Node* node)
+Frame* toDynamicFrame(ExecState* exec)
 {
-    if (!node)
-        return 0;
-    Document* document = node->document();
-    if (!document)
-        return 0;
-    Frame* frame = document->frame();
+    return asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+}
+
+bool processingUserGesture(ExecState* exec)
+{
+    Frame* frame = toDynamicFrame(exec);
+    return frame && frame->script()->processingUserGesture();
+}
+
+KURL completeURL(ExecState* exec, const String& relativeURL)
+{
+    // For histoical reasons, we need to complete the URL using the dynamic frame.
+    Frame* frame = toDynamicFrame(exec);
     if (!frame)
-        return 0;
-    if (!frame->script()->isEnabled())
-        return 0;
-    return frame->script()->globalObject()->globalExec();
+        return KURL();
+    return frame->loader()->completeURL(relativeURL);
 }
 
-Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+JSValue objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    return new (exec) PrototypeFunction(exec, 0, propertyName, objectProtoFuncToString);
+}
+
+Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInfo* classInfo)
+{
+    JSDOMStructureMap& structures = globalObject->structures();
     return structures.get(classInfo).get();
 }
 
-Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    JSDOMStructureMap& structures = globalObject->structures();
     ASSERT(!structures.contains(classInfo));
     return structures.set(classInfo, structure).first->second.get();
 }
 
+Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+{
+    return getCachedDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), classInfo);
+}
+
+Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+{
+    return cacheDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), structure, classInfo);
+}
+
 JSObject* getCachedDOMConstructor(ExecState* exec, const ClassInfo* classInfo)
 {
     JSDOMConstructorMap& constructors = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->constructors();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 71da21b..1378c91 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -25,7 +25,6 @@
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
 #include <runtime/JSFunction.h>
-#include "ScriptState.h"
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -73,21 +72,27 @@ namespace WebCore {
     void markActiveObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::JSGlobalData& globalData, void* object);
 
+    JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
-    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
     {
-        if (JSC::Structure* structure = getCachedDOMStructure(exec, &WrapperClass::s_info))
+        if (JSC::Structure* structure = getCachedDOMStructure(globalObject, &WrapperClass::s_info))
             return structure;
-        return cacheDOMStructure(exec, WrapperClass::createStructure(WrapperClass::createPrototype(exec)), &WrapperClass::s_info);
+        return cacheDOMStructure(globalObject, WrapperClass::createStructure(WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
+    }
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    {
+        return getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()));
     }
-    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
     {
-        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec)->storedPrototype()));
+        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(globalObject))->storedPrototype()));
     }
     #define CREATE_DOM_OBJECT_WRAPPER(exec, className, object) createDOMObjectWrapper<JS##className>(exec, static_cast<className*>(object))
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
@@ -98,7 +103,7 @@ namespace WebCore {
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
     {
         if (!object)
             return JSC::jsNull();
@@ -117,7 +122,7 @@ namespace WebCore {
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
     {
         if (!object)
             return JSC::jsNull();
@@ -136,7 +141,7 @@ namespace WebCore {
         cacheDOMNodeWrapper(node->document(), node, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
     {
         if (!node)
             return JSC::jsNull();
@@ -147,29 +152,29 @@ namespace WebCore {
 
     const JSC::HashTable* getHashTableForGlobalData(JSC::JSGlobalData&, const JSC::HashTable* staticTable);
 
-    void reportException(JSC::ExecState*, JSC::JSValuePtr exception);
+    void reportException(JSC::ExecState*, JSC::JSValue exception);
     void reportCurrentException(JSC::ExecState*);
 
     // Convert a DOM implementation exception code into a JavaScript exception in the execution state.
     void setDOMException(JSC::ExecState*, ExceptionCode);
 
-    JSC::JSValuePtr jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
-    JSC::JSValuePtr jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
+    JSC::JSValue jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
+    JSC::JSValue jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
 
-    JSC::JSValuePtr jsStringOrUndefined(JSC::ExecState*, const String&); // undefined if the string is null
-    JSC::JSValuePtr jsStringOrUndefined(JSC::ExecState*, const KURL&); // undefined if the URL is null
+    JSC::JSValue jsStringOrUndefined(JSC::ExecState*, const String&); // undefined if the string is null
+    JSC::JSValue jsStringOrUndefined(JSC::ExecState*, const KURL&); // undefined if the URL is null
 
-    JSC::JSValuePtr jsStringOrFalse(JSC::ExecState*, const String&); // boolean false if the string is null
-    JSC::JSValuePtr jsStringOrFalse(JSC::ExecState*, const KURL&); // boolean false if the URL is null
+    JSC::JSValue jsStringOrFalse(JSC::ExecState*, const String&); // boolean false if the string is null
+    JSC::JSValue jsStringOrFalse(JSC::ExecState*, const KURL&); // boolean false if the URL is null
 
     // See JavaScriptCore for explanation: Should be used for any UString that is already owned by another
     // object, to let the engine know that collecting the JSString wrapper is unlikely to save memory.
-    JSC::JSValuePtr jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
+    JSC::JSValue jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
 
-    JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValuePtr); // null if the value is null
-    JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValuePtr); // null if the value is null or undefined
+    JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null
+    JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null or undefined
 
-    template <typename T> inline JSC::JSValuePtr toJS(JSC::ExecState* exec, PassRefPtr<T> ptr) { return toJS(exec, ptr.get()); }
+    template <typename T> inline JSC::JSValue toJS(JSC::ExecState* exec, PassRefPtr<T> ptr) { return toJS(exec, ptr.get()); }
 
     bool checkNodeSecurity(JSC::ExecState*, Node*);
 
@@ -178,10 +183,14 @@ namespace WebCore {
     // because we do not want current property values involved at all.
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*);
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*, String& message);
+    bool shouldAllowNavigation(JSC::ExecState*, Frame*);
     void printErrorMessageForFrame(Frame*, const String& message);
-    JSC::JSValuePtr objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
+    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
 
-    ScriptState* scriptStateFromNode(Node*);
+    Frame* toLexicalFrame(JSC::ExecState*);
+    Frame* toDynamicFrame(JSC::ExecState*);
+    bool processingUserGesture(JSC::ExecState*);
+    KURL completeURL(JSC::ExecState*, const String& relativeURL);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index ae339ed..a7f7b21 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -30,8 +30,11 @@
 #include "Document.h"
 #include "JSDOMWindow.h"
 #include "JSEventListener.h"
+
+#if ENABLE(WORKERS)
 #include "JSWorkerContext.h"
 #include "WorkerContext.h"
+#endif
 
 using namespace JSC;
 
@@ -49,26 +52,10 @@ JSDOMGlobalObject::JSDOMGlobalObject(PassRefPtr<Structure> structure, JSDOMGloba
 
 JSDOMGlobalObject::~JSDOMGlobalObject()
 {
-    // Clear any backpointers to the window
-    ListenersMap::iterator i1 = d()->jsEventListeners.begin();
-    ListenersMap::iterator e1 = d()->jsEventListeners.end();
-    for (; i1 != e1; ++i1)
-        i1->second->clearGlobalObject();
-
-    i1 = d()->jsInlineEventListeners.begin();
-    e1 = d()->jsInlineEventListeners.end();
-    for (; i1 != e1; ++i1)
-        i1->second->clearGlobalObject();
-
-    UnprotectedListenersMap::iterator i2 = d()->jsUnprotectedEventListeners.begin();
-    UnprotectedListenersMap::iterator e2 = d()->jsUnprotectedEventListeners.end();
-    for (; i2 != e2; ++i2)
-        i2->second->clearGlobalObject();
-
-    i2 = d()->jsUnprotectedInlineEventListeners.begin();
-    e2 = d()->jsUnprotectedInlineEventListeners.end();
-    for (; i2 != e2; ++i2)
-        i2->second->clearGlobalObject();
+    JSListenersMap::iterator it = d()->jsEventListeners.begin();
+    JSListenersMap::iterator end = d()->jsEventListeners.end();
+    for (; it != end; ++it)
+        it->second->clearGlobalObject();
 }
 
 void JSDOMGlobalObject::mark()
@@ -86,74 +73,45 @@ void JSDOMGlobalObject::mark()
     }
 }
 
-JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValuePtr val, bool isInline)
+JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue val)
 {
-    if (!val->isObject())
+    if (!val.isObject())
         return 0;
-    JSObject* object = asObject(val);
-    ListenersMap& listeners = isInline ? d()->jsInlineEventListeners : d()->jsEventListeners;
-    return listeners.get(object);
+
+    return d()->jsEventListeners.get(asObject(val));
 }
 
-PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(ExecState*, JSValuePtr val, bool isInline)
+PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(JSValue val)
 {
-    if (JSEventListener* listener = findJSEventListener(val, isInline))
+    if (JSEventListener* listener = findJSEventListener(val))
         return listener;
 
-    if (!val->isObject())
+    if (!val.isObject())
         return 0;
 
     // The JSEventListener constructor adds it to our jsEventListeners map.
-    return JSEventListener::create(asObject(val), this, isInline).get();
-}
-
-JSUnprotectedEventListener* JSDOMGlobalObject::findJSUnprotectedEventListener(ExecState*, JSValuePtr val, bool isInline)
-{
-    if (!val->isObject())
-        return 0;
-
-    UnprotectedListenersMap& listeners = isInline ? d()->jsUnprotectedInlineEventListeners : d()->jsUnprotectedEventListeners;
-    return listeners.get(asObject(val));
+    return JSEventListener::create(asObject(val), this, false).get();
 }
 
-PassRefPtr<JSUnprotectedEventListener> JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener(ExecState* exec, JSValuePtr val, bool isInline)
+PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
 {
-    if (JSUnprotectedEventListener* listener = findJSUnprotectedEventListener(exec, val, isInline))
-        return listener;
-
-    if (!val->isObject())
+    if (!val.isObject())
         return 0;
 
-    // The JSUnprotectedEventListener constructor adds it to our jsUnprotectedEventListeners map.
-    return JSUnprotectedEventListener::create(asObject(val), this, isInline).get();
+    return JSEventListener::create(asObject(val), this, true).get();
 }
 
-JSDOMGlobalObject::ListenersMap& JSDOMGlobalObject::jsEventListeners()
+JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsEventListeners()
 {
     return d()->jsEventListeners;
 }
 
-JSDOMGlobalObject::ListenersMap& JSDOMGlobalObject::jsInlineEventListeners()
-{
-    return d()->jsInlineEventListeners;
-}
-
-JSDOMGlobalObject::UnprotectedListenersMap& JSDOMGlobalObject::jsUnprotectedEventListeners()
-{
-    return d()->jsUnprotectedEventListeners;
-}
-
-JSDOMGlobalObject::UnprotectedListenersMap& JSDOMGlobalObject::jsUnprotectedInlineEventListeners()
-{
-    return d()->jsUnprotectedInlineEventListeners;
-}
-
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
 {
     d()->evt = evt;
 }
 
-Event* JSDOMGlobalObject::currentEvent()
+Event* JSDOMGlobalObject::currentEvent() const
 {
     return d()->evt;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index fbb3eb9..8e4e820 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -32,8 +32,8 @@
 namespace WebCore {
 
     class Event;
+    class JSLazyEventListener;
     class JSEventListener;
-    class JSUnprotectedEventListener;
     class ScriptExecutionContext;
 
     typedef HashMap<const JSC::ClassInfo*, RefPtr<JSC::Structure> > JSDOMStructureMap;
@@ -53,28 +53,22 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Finds a wrapper of a JS EventListener, returns 0 if no existing one.
-        JSEventListener* findJSEventListener(JSC::JSValuePtr, bool isInline = false);
-
-        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is GC-protected.
-        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
-
         // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
-        JSUnprotectedEventListener* findJSUnprotectedEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
+        JSEventListener* findJSEventListener(JSC::JSValue);
 
         // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
-        PassRefPtr<JSUnprotectedEventListener> findOrCreateJSUnprotectedEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
+        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::JSValue);
+
+        // Creates a GC-protected JS EventListener for an "onXXX" event attribute.
+        // These listeners cannot be removed through the removeEventListener API.
+        PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
 
-        typedef HashMap<JSC::JSObject*, JSEventListener*> ListenersMap;
-        typedef HashMap<JSC::JSObject*, JSUnprotectedEventListener*> UnprotectedListenersMap;
+        typedef HashMap<JSC::JSObject*, JSEventListener*> JSListenersMap;
 
-        ListenersMap& jsEventListeners();
-        ListenersMap& jsInlineEventListeners();
-        UnprotectedListenersMap& jsUnprotectedEventListeners();
-        UnprotectedListenersMap& jsUnprotectedInlineEventListeners();
+        JSListenersMap& jsEventListeners();
 
         void setCurrentEvent(Event*);
-        Event* currentEvent();
+        Event* currentEvent() const;
 
         virtual void mark();
 
@@ -85,10 +79,7 @@ namespace WebCore {
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
-            JSDOMGlobalObject::ListenersMap jsEventListeners;
-            JSDOMGlobalObject::ListenersMap jsInlineEventListeners;
-            JSDOMGlobalObject::UnprotectedListenersMap jsUnprotectedEventListeners;
-            JSDOMGlobalObject::UnprotectedListenersMap jsUnprotectedInlineEventListeners;
+            JSDOMGlobalObject::JSListenersMap jsEventListeners;
 
             Event* evt;
         };
@@ -108,11 +99,11 @@ namespace WebCore {
     }
 
     template<class ConstructorClass>
-    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
+    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, const JSDOMGlobalObject* globalObject)
     {
         if (JSC::JSObject* constructor = globalObject->constructors().get(&ConstructorClass::s_info))
             return constructor;
-        JSC::JSObject* constructor = new (exec) ConstructorClass(exec, globalObject->scriptExecutionContext());
+        JSC::JSObject* constructor = new (exec) ConstructorClass(exec, const_cast<JSDOMGlobalObject*>(globalObject));
         ASSERT(!globalObject->constructors().contains(&ConstructorClass::s_info));
         globalObject->constructors().set(&ConstructorClass::s_info, constructor);
         return constructor;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp
index ccf0ce8..ac088af 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp
@@ -32,14 +32,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSDOMStringList::getByIndex(ExecState* exec, unsigned index)
+JSValue JSDOMStringList::getByIndex(ExecState* exec, unsigned index)
 {
     return jsString(exec, impl()->item(index));
 }
 
-JSValuePtr JSDOMStringList::item(ExecState* exec, const ArgList& args)
+JSValue JSDOMStringList::item(ExecState* exec, const ArgList& args)
 {
-    unsigned index = args.at(exec, 0)->toUInt32(exec);
+    unsigned index = args.at(0).toUInt32(exec);
     if (index >= impl()->length())
         return jsNull();
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index 10fc022..4fd1139 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *
  *  This library is free software; you can redistribute it and/or
@@ -25,107 +25,29 @@
 
 #include "CString.h"
 #include "Console.h"
-#include "DOMTimer.h"
 #include "DOMWindow.h"
 #include "Element.h"
-#include "EventListener.h"
-#include "ExceptionCode.h"
-#include "FloatRect.h"
 #include "Frame.h"
-#include "FrameLoadRequest.h"
-#include "FrameLoader.h"
-#include "FrameTree.h"
-#include "GCController.h"
+#include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "InspectorController.h"
-#include "JSAudioConstructor.h"
 #include "JSDOMWindowCustom.h"
-#include "JSEvent.h"
-#include "JSEventListener.h"
 #include "JSHTMLCollection.h"
-#include "JSImageConstructor.h"
-#include "JSMessageChannelConstructor.h"
 #include "JSNode.h"
-#include "JSOptionConstructor.h"
-#include "JSWorkerConstructor.h"
-#include "JSXMLHttpRequestConstructor.h"
-#include "JSXSLTProcessorConstructor.h"
 #include "Logging.h"
-#include "MediaPlayer.h"
 #include "Page.h"
-#include "PlatformScreen.h"
-#include "PluginInfoStore.h"
-#include "RenderView.h"
-#include "ScheduledAction.h"
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
-#include "WindowFeatures.h"
-#include "htmlediting.h"
-#include <runtime/Error.h>
-#include <runtime/JSLock.h>
-#include <wtf/AlwaysInline.h>
-#include <wtf/MathExtras.h>
 
 using namespace JSC;
 
-static JSValuePtr windowProtoFuncOpen(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr windowProtoFuncShowModalDialog(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr windowProtoFuncNotImplemented(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-
-static JSValuePtr jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsDOMWindowBaseEvent(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseEvent(ExecState*, JSObject*, JSValuePtr);
-
-// Constructors
-static JSValuePtr jsDOMWindowBaseAudio(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseAudio(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseImage(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseImage(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseMessageChannel(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseMessageChannel(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseWorker(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseWorker(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseOption(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseOption(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseXMLHttpRequest(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseXMLHttpRequest(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseXSLTProcessor(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseXSLTProcessor(ExecState*, JSObject*, JSValuePtr);
-
-#include "JSDOMWindowBase.lut.h"
-
 namespace WebCore {
 
-////////////////////// JSDOMWindowBase Object ////////////////////////
-
-const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, &JSDOMWindowBaseTable, 0 };
-
-/*
-@begin JSDOMWindowBaseTable
-# -- Functions --
-  open                          windowProtoFuncOpen                         DontDelete|Function 3
-  showModalDialog               windowProtoFuncShowModalDialog              DontDelete|Function 1
-# Not implemented
-  captureEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
-  releaseEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
-# -- Attributes --
-  crypto                        jsDOMWindowBaseCrypto                       DontDelete|ReadOnly
-  event                         jsDOMWindowBaseEvent                        DontDelete
-# -- Constructors --
-  Audio                         jsDOMWindowBaseAudio                        DontDelete
-  Image                         jsDOMWindowBaseImage                        DontDelete
-  MessageChannel                jsDOMWindowBaseMessageChannel               DontDelete
-  Option                        jsDOMWindowBaseOption                       DontDelete
-  Worker                        jsDOMWindowBaseWorker                       DontDelete
-  XMLHttpRequest                jsDOMWindowBaseXMLHttpRequest               DontDelete
-  XSLTProcessor                 jsDOMWindowBaseXSLTProcessor                DontDelete
-@end
-*/
+const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
 JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : impl(window)
-    , returnValueSlot(0)
     , shell(shell)
 {
 }
@@ -133,9 +55,6 @@ JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow>
 JSDOMWindowBase::JSDOMWindowBase(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
-    // Time in milliseconds before the script timeout handler kicks in.
-    setTimeoutTime(10000);
-
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(globalExec(), "document"), jsNull(), DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(globalExec(), "window"), d()->shell, DontDelete | ReadOnly)
@@ -151,368 +70,22 @@ void JSDOMWindowBase::updateDocument()
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, d()->impl->document()), DontDelete | ReadOnly);
 }
 
-JSDOMWindowBase::~JSDOMWindowBase()
-{
-    if (d()->impl->frame())
-        d()->impl->frame()->script()->clearFormerWindow(asJSDOMWindow(this));
-}
-
 ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
 {
     return d()->impl->document();
 }
 
-static bool allowPopUp(ExecState* exec)
-{
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-
-    ASSERT(frame);
-    if (frame->script()->processingUserGesture())
-        return true;
-    Settings* settings = frame->settings();
-    return settings && settings->JavaScriptCanOpenWindowsAutomatically();
-}
-
-static HashMap<String, String> parseModalDialogFeatures(const String& featuresArg)
-{
-    HashMap<String, String> map;
-
-    Vector<String> features;
-    featuresArg.split(';', features);
-    Vector<String>::const_iterator end = features.end();
-    for (Vector<String>::const_iterator it = features.begin(); it != end; ++it) {
-        String s = *it;
-        int pos = s.find('=');
-        int colonPos = s.find(':');
-        if (pos >= 0 && colonPos >= 0)
-            continue; // ignore any strings that have both = and :
-        if (pos < 0)
-            pos = colonPos;
-        if (pos < 0) {
-            // null string for value means key without value
-            map.set(s.stripWhiteSpace().lower(), String());
-        } else {
-            String key = s.left(pos).stripWhiteSpace().lower();
-            String val = s.substring(pos + 1).stripWhiteSpace().lower();
-            int spacePos = val.find(' ');
-            if (spacePos != -1)
-                val = val.left(spacePos);
-            map.set(key, val);
-        }
-    }
-
-    return map;
-}
-
-static Frame* createWindow(ExecState* exec, Frame* openerFrame, const String& url,
-    const String& frameName, const WindowFeatures& windowFeatures, JSValuePtr dialogArgs)
-{
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    ASSERT(activeFrame);
-
-    ResourceRequest request;
-
-    request.setHTTPReferrer(activeFrame->loader()->outgoingReferrer());
-    FrameLoader::addHTTPOriginIfNeeded(request, activeFrame->loader()->outgoingOrigin());
-    FrameLoadRequest frameRequest(request, frameName);
-
-    // FIXME: It's much better for client API if a new window starts with a URL, here where we
-    // know what URL we are going to open. Unfortunately, this code passes the empty string
-    // for the URL, but there's a reason for that. Before loading we have to set up the opener,
-    // openedByDOM, and dialogArguments values. Also, to decide whether to use the URL we currently
-    // do an allowsAccessFrom call using the window we create, which can't be done before creating it.
-    // We'd have to resolve all those issues to pass the URL instead of "".
-
-    bool created;
-    // We pass in the opener frame here so it can be used for looking up the frame name, in case the active frame
-    // is different from the opener frame, and the name references a frame relative to the opener frame, for example
-    // "_self" or "_parent".
-    Frame* newFrame = activeFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
-    if (!newFrame)
-        return 0;
-
-    newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
-
-    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
-
-    if (dialogArgs)
-        newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
-
-    if (!protocolIs(url, "javascript") || newWindow->allowsAccessFrom(exec)) {
-        KURL completedURL = url.isEmpty() ? KURL("") : activeFrame->document()->completeURL(url);
-        bool userGesture = activeFrame->script()->processingUserGesture();
-
-        if (created)
-            newFrame->loader()->changeLocation(completedURL, activeFrame->loader()->outgoingReferrer(), false, userGesture);
-        else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedURL.string(), activeFrame->loader()->outgoingReferrer(), false, userGesture);
-    }
-
-    return newFrame;
-}
-
-static bool canShowModalDialog(const Frame* frame)
-{
-    if (!frame)
-        return false;
-
-    Page* page = frame->page();
-    if (!page)
-        return false;
-
-    return page->chrome()->canRunModal();
-}
-
-static bool canShowModalDialogNow(const Frame* frame)
-{
-    if (!frame)
-        return false;
-
-    Page* page = frame->page();
-    if (!page)
-        return false;
-
-    return page->chrome()->canRunModalNow();
-}
-
-static JSValuePtr showModalDialog(ExecState* exec, Frame* frame, const String& url, JSValuePtr dialogArgs, const String& featureArgs)
-{
-    if (!canShowModalDialogNow(frame) || !allowPopUp(exec))
-        return jsUndefined();
-
-    const HashMap<String, String> features = parseModalDialogFeatures(featureArgs);
-
-    const bool trusted = false;
-
-    // The following features from Microsoft's documentation are not implemented:
-    // - default font settings
-    // - width, height, left, and top specified in units other than "px"
-    // - edge (sunken or raised, default is raised)
-    // - dialogHide: trusted && boolFeature(features, "dialoghide"), makes dialog hide when you print
-    // - help: boolFeature(features, "help", true), makes help icon appear in dialog (what does it do on Windows?)
-    // - unadorned: trusted && boolFeature(features, "unadorned");
-
-    if (!frame)
-        return jsUndefined();
-
-    FloatRect screenRect = screenAvailableRect(frame->view());
-
-    WindowFeatures wargs;
-    wargs.width = WindowFeatures::floatFeature(features, "dialogwidth", 100, screenRect.width(), 620); // default here came from frame size of dialog in MacIE
-    wargs.widthSet = true;
-    wargs.height = WindowFeatures::floatFeature(features, "dialogheight", 100, screenRect.height(), 450); // default here came from frame size of dialog in MacIE
-    wargs.heightSet = true;
-
-    wargs.x = WindowFeatures::floatFeature(features, "dialogleft", screenRect.x(), screenRect.right() - wargs.width, -1);
-    wargs.xSet = wargs.x > 0;
-    wargs.y = WindowFeatures::floatFeature(features, "dialogtop", screenRect.y(), screenRect.bottom() - wargs.height, -1);
-    wargs.ySet = wargs.y > 0;
-
-    if (WindowFeatures::boolFeature(features, "center", true)) {
-        if (!wargs.xSet) {
-            wargs.x = screenRect.x() + (screenRect.width() - wargs.width) / 2;
-            wargs.xSet = true;
-        }
-        if (!wargs.ySet) {
-            wargs.y = screenRect.y() + (screenRect.height() - wargs.height) / 2;
-            wargs.ySet = true;
-        }
-    }
-
-    wargs.dialog = true;
-    wargs.resizable = WindowFeatures::boolFeature(features, "resizable");
-    wargs.scrollbarsVisible = WindowFeatures::boolFeature(features, "scroll", true);
-    wargs.statusBarVisible = WindowFeatures::boolFeature(features, "status", !trusted);
-    wargs.menuBarVisible = false;
-    wargs.toolBarVisible = false;
-    wargs.locationBarVisible = false;
-    wargs.fullscreen = false;
-
-    Frame* dialogFrame = createWindow(exec, frame, url, "", wargs, dialogArgs);
-    if (!dialogFrame)
-        return jsUndefined();
-
-    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
-
-    // Get the return value either just before clearing the dialog window's
-    // properties (in JSDOMWindowBase::clear), or when on return from runModal.
-    JSValuePtr returnValue = noValue();
-    dialogWindow->setReturnValueSlot(&returnValue);
-    dialogFrame->page()->chrome()->runModal();
-    dialogWindow->setReturnValueSlot(0);
-
-    // If we don't have a return value, get it now.
-    // Either JSDOMWindowBase::clear was not called yet, or there was no return value,
-    // and in that case, there's no harm in trying again (no benefit either).
-    if (!returnValue)
-        returnValue = dialogWindow->getDirect(Identifier(exec, "returnValue"));
-
-    return returnValue ? returnValue : jsUndefined();
-}
-
-} // namespace WebCore
-
-using namespace WebCore;
-
-JSValuePtr jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&)
-{
-    return jsUndefined(); // FIXME: implement this
-}
-
-JSValuePtr jsDOMWindowBaseEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent())
-        return jsUndefined();
-    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent());
-}
-
-JSValuePtr jsDOMWindowBaseImage(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSImageConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseMessageChannel(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(CHANNEL_MESSAGING)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSMessageChannelConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-#else
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseOption(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSOptionConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseXMLHttpRequest(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseAudio(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(VIDEO)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    if (!MediaPlayer::isAvailable())
-        return jsUndefined();
-    return getDOMConstructor<JSAudioConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-#else
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseWorker(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(WORKERS)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSWorkerConstructor>(exec);
-#else
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseXSLTProcessor(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(XSLT)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSXSLTProcessorConstructor>(exec);
-#else
-    return jsUndefined();
-#endif
-}
-
-void setJSDOMWindowBaseEvent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Event"), value);
-}
-
-void setJSDOMWindowBaseAudio(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Audio"), value);
-}
-
-void setJSDOMWindowBaseImage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Image"), value);
-}
-
-void setJSDOMWindowBaseMessageChannel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "MessageChannel"), value);
-}
-
-void setJSDOMWindowBaseOption(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Option"), value);
-}
-
-void setJSDOMWindowBaseWorker(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Worker"), value);
-}
-
-void setJSDOMWindowBaseXMLHttpRequest(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
-}
-
-void setJSDOMWindowBaseXSLTProcessor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "XSLTProcessor"), value);
-}
-
-namespace WebCore {
-
-JSValuePtr JSDOMWindowBase::childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSDOMWindowBase::childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
 }
 
-JSValuePtr JSDOMWindowBase::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSDOMWindowBase::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
 }
 
-JSValuePtr JSDOMWindowBase::namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSDOMWindowBase::namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSDOMWindowBase* thisObj = static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()));
     Document* doc = thisObj->impl()->frame()->document();
@@ -538,26 +111,10 @@ bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& prop
         return true;
     }
 
-    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == windowProtoFuncShowModalDialog) {
-                if (!canShowModalDialog(impl()->frame()))
-                    return false;
-            }
-            if (allowsAccessFrom(exec))
-                setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-            else
-                slot.setUndefined();
-        } else
-            slot.setCustom(this, entry->propertyGetter());
-        return true;
-    }
-
     // Do prototype lookup early so that functions and attributes in the prototype can have
     // precedence over the index and name getters.  
-    JSValuePtr proto = prototype();
-    if (proto->isObject()) {
+    JSValue proto = prototype();
+    if (proto.isObject()) {
         if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
             if (!allowsAccessFrom(exec))
                 slot.setUndefined();
@@ -583,7 +140,7 @@ bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& prop
 
     // Allow shortcuts like 'Image1' instead of document.images.Image1
     Document* document = impl()->frame()->document();
-    if (document && document->isHTMLDocument()) {
+    if (document->isHTMLDocument()) {
         AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
         if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
             slot.setCustom(this, namedItemGetter);
@@ -594,19 +151,8 @@ bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSDOMWindowBase::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMWindowBase::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (allowsAccessFrom(exec))
-                Base::put(exec, propertyName, value, slot);
-            return;
-        }
-        if (entry->attributes() & ReadOnly)
-            return;
-    }
-
     if (allowsAccessFrom(exec))
         Base::put(exec, propertyName, value, slot);
 }
@@ -653,6 +199,9 @@ ExecState* JSDOMWindowBase::globalExec()
 
 bool JSDOMWindowBase::supportsProfiling() const
 {
+#if !ENABLE(JAVASCRIPT_DEBUGGER)
+    return false;
+#else
     Frame* frame = impl()->frame();
     if (!frame)
         return false;
@@ -662,6 +211,7 @@ bool JSDOMWindowBase::supportsProfiling() const
         return false;
 
     return page->inspectorController()->profilerEnabled();
+#endif
 }
 
 bool JSDOMWindowBase::shouldInterruptScript() const
@@ -682,21 +232,11 @@ bool JSDOMWindowBase::shouldInterruptScript() const
     return page->chrome()->shouldInterruptJavaScript();
 }
 
-void JSDOMWindowBase::clearHelperObjectProperties()
+void JSDOMWindowBase::willRemoveFromWindowShell()
 {
     setCurrentEvent(0);
 }
 
-void JSDOMWindowBase::clear()
-{
-    JSLock lock(false);
-
-    if (d()->returnValueSlot && !*d()->returnValueSlot)
-        *d()->returnValueSlot = getDirect(Identifier(globalExec(), "returnValue"));
-
-    clearHelperObjectProperties();
-}
-
 JSObject* JSDOMWindowBase::toThisObject(ExecState*) const
 {
     return shell();
@@ -709,141 +249,16 @@ JSDOMWindowShell* JSDOMWindowBase::shell() const
 
 JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
 {
-    static JSGlobalData* globalData = JSGlobalData::createLeaked().releaseRef();
-    return globalData;
-}
-
-} // namespace WebCore
-
-using namespace WebCore;
-
-JSValuePtr windowProtoFuncOpen(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    JSDOMWindow* window = toJSDOMWindow(thisValue);
-    if (!window)
-        return throwError(exec, TypeError);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    Frame* frame = window->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
-        return  jsUndefined();
-
-    Page* page = frame->page();
-
-    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
-    AtomicString frameName = args.at(exec, 1)->isUndefinedOrNull() ? "_blank" : AtomicString(args.at(exec, 1)->toString(exec));
-
-    // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
-    // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
-    if (!allowPopUp(exec) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
-        return jsUndefined();
-
-    // Get the target frame for the special cases of _top and _parent.  In those
-    // cases, we can schedule a location change right now and return early.
-    bool topOrParent = false;
-    if (frameName == "_top") {
-        frame = frame->tree()->top();
-        topOrParent = true;
-    } else if (frameName == "_parent") {
-        if (Frame* parent = frame->tree()->parent())
-            frame = parent;
-        topOrParent = true;
+    static JSGlobalData* globalData;
+    if (!globalData) {
+        globalData = JSGlobalData::createLeaked().releaseRef();
+        globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
     }
-    if (topOrParent) {
-        if (!activeFrame->loader()->shouldAllowNavigation(frame))
-            return jsUndefined();
-
-        String completedURL;
-        if (!urlString.isEmpty())
-            completedURL = activeFrame->document()->completeURL(urlString).string();
-
-        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
-        if (!completedURL.isEmpty() && (!protocolIs(completedURL, "javascript") || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
-            bool userGesture = activeFrame->script()->processingUserGesture();
-            frame->loader()->scheduleLocationChange(completedURL, activeFrame->loader()->outgoingReferrer(), false, userGesture);
-        }
-        return toJS(exec, frame->domWindow());
-    }
-
-    // In the case of a named frame or a new window, we'll use the createWindow() helper
-    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
-    FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
-                         windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
-    DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
-
-    windowFeatures.x = windowRect.x();
-    windowFeatures.y = windowRect.y();
-    windowFeatures.height = windowRect.height();
-    windowFeatures.width = windowRect.width();
-
-    frame = createWindow(exec, frame, urlString, frameName, windowFeatures, noValue());
-
-    if (!frame)
-        return jsUndefined();
-
-    return toJS(exec, frame->domWindow()); // global object
-}
-
-JSValuePtr windowProtoFuncShowModalDialog(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    JSDOMWindow* window = toJSDOMWindow(thisValue);
-    if (!window)
-        return throwError(exec, TypeError);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    Frame* frame = window->impl()->frame();
-    if (!frame)
-        return jsUndefined();
 
-    return showModalDialog(exec, frame, valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0)), args.at(exec, 1), valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
-}
-
-JSValuePtr windowProtoFuncNotImplemented(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
-{
-    if (!toJSDOMWindow(thisValue))
-        return throwError(exec, TypeError);
-    return jsUndefined();
-}
-
-namespace WebCore {
-
-void JSDOMWindowBase::setReturnValueSlot(JSValuePtr* slot)
-{
-    d()->returnValueSlot = slot;
-}
-
-////////////////////// timeouts ////////////////////////
-
-int JSDOMWindowBase::installTimeout(ScheduledAction* a, int t, bool singleShot)
-{
-    return DOMTimer::install(scriptExecutionContext(), a, t, singleShot);
-}
-
-int JSDOMWindowBase::installTimeout(const UString& handler, int t, bool singleShot)
-{
-    return installTimeout(new ScheduledAction(handler), t, singleShot);
-}
-
-int JSDOMWindowBase::installTimeout(ExecState* exec, JSValuePtr func, const ArgList& args, int t, bool singleShot)
-{
-    return installTimeout(new ScheduledAction(exec, func, args), t, singleShot);
-}
-
-void JSDOMWindowBase::removeTimeout(int timeoutId)
-{
-    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
-}
-
-void JSDOMWindowBase::disconnectFrame()
-{
+    return globalData;
 }
 
-JSValuePtr toJS(ExecState*, DOMWindow* domWindow)
+JSValue toJS(ExecState*, DOMWindow* domWindow)
 {
     if (!domWindow)
         return jsNull();
@@ -860,9 +275,9 @@ JSDOMWindow* toJSDOMWindow(Frame* frame)
     return frame->script()->windowShell()->window();
 }
 
-JSDOMWindow* toJSDOMWindow(JSValuePtr value)
+JSDOMWindow* toJSDOMWindow(JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
     const ClassInfo* classInfo = asObject(value)->classInfo();
     if (classInfo == &JSDOMWindow::s_info)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 2398172..6d93196 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -34,10 +34,8 @@ namespace WebCore {
     class Frame;
     class JSDOMWindow;
     class JSDOMWindowShell;
-    class JSEventListener;
     class JSLocation;
-    class JSUnprotectedEventListener;
-    class ScheduledAction;
+    class JSEventListener;
     class SecurityOrigin;
 
     class JSDOMWindowBasePrivate;
@@ -45,32 +43,20 @@ namespace WebCore {
     // This is the only WebCore JS binding which does not inherit from DOMObject
     class JSDOMWindowBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
-
-        friend class ScheduledAction;
     protected:
         JSDOMWindowBase(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        virtual ~JSDOMWindowBase();
-
         void updateDocument();
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        void disconnectFrame();
-
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
 
-        int installTimeout(const JSC::UString& handler, int t, bool singleShot);
-        int installTimeout(JSC::ExecState*, JSC::JSValuePtr function, const JSC::ArgList& args, int t, bool singleShot);
-        void removeTimeout(int timeoutId);
-
-        void clear();
-
-        // Set a place to put a dialog return value when the window is cleared.
-        void setReturnValueSlot(JSC::JSValuePtr* slot);
+        // Called just before removing this window from the JSDOMWindowShell.
+        void willRemoveFromWindowShell();
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
@@ -100,17 +86,12 @@ namespace WebCore {
             JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
             RefPtr<DOMWindow> impl;
-
-            JSC::JSValuePtr* returnValueSlot;
             JSDOMWindowShell* shell;
         };
 
-        static JSC::JSValuePtr childFrameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr namedItemGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        void clearHelperObjectProperties();
-        int installTimeout(ScheduledAction*, int interval, bool singleShot);
+        static JSC::JSValue childFrameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue namedItemGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
@@ -119,11 +100,11 @@ namespace WebCore {
     };
 
     // Returns a JSDOMWindow or jsNull()
-    JSC::JSValuePtr toJS(JSC::ExecState*, DOMWindow*);
+    JSC::JSValue toJS(JSC::ExecState*, DOMWindow*);
 
     // Returns JSDOMWindow or 0
     JSDOMWindow* toJSDOMWindow(Frame*);
-    JSDOMWindow* toJSDOMWindow(JSC::JSValuePtr);
+    JSDOMWindow* toJSDOMWindow(JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2c5f882..b8c30c7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,17 +25,39 @@
 #include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
+#include "FloatRect.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
+#include "FrameView.h"
+#include "History.h"
+#include "JSAudioConstructor.h"
 #include "JSDOMWindowShell.h"
+#include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSHistory.h"
+#include "JSImageConstructor.h"
+#include "JSLocation.h"
+#include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSOptionConstructor.h"
+#include "JSWebKitCSSMatrixConstructor.h"
+#include "JSWebKitPointConstructor.h"
+#include "JSWorkerConstructor.h"
+#include "JSXMLHttpRequestConstructor.h"
+#include "JSXSLTProcessorConstructor.h"
+#include "Location.h"
+#include "MediaPlayer.h"
 #include "MessagePort.h"
+#include "Page.h"
+#include "PlatformScreen.h"
+#include "RegisteredEventListener.h"
+#include "ScheduledAction.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "WindowFeatures.h"
 #include <runtime/JSObject.h>
-#include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
 
@@ -45,6 +67,8 @@ void JSDOMWindow::mark()
 {
     Base::mark();
 
+    markEventListeners(impl()->eventListeners());
+
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
     markDOMObjectWrapper(globalData, impl()->optionalConsole());
@@ -97,6 +121,11 @@ void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName,
     // Only allow defining getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
+
+    // Don't allow shadowing location using defineGetter.
+    if (propertyName == "location")
+        return;
+
     Base::defineGetter(exec, propertyName, getterFunction);
 }
 
@@ -108,7 +137,7 @@ void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName,
     Base::defineSetter(exec, propertyName, setterFunction);
 }
 
-JSValuePtr JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow looking-up getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -116,7 +145,7 @@ JSValuePtr JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& property
     return Base::lookupGetter(exec, propertyName);
 }
 
-JSValuePtr JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow looking-up setters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -124,17 +153,41 @@ JSValuePtr JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& property
     return Base::lookupSetter(exec, propertyName);
 }
 
-void JSDOMWindow::setLocation(ExecState* exec, JSValuePtr value)
+// Custom Attributes
+
+JSValue JSDOMWindow::history(ExecState* exec) const
+{
+    History* history = impl()->history();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+        return wrapper;
+
+    JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, const_cast<JSDOMWindow*>(this)), history);
+    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    return jsHistory;
+}
+
+JSValue JSDOMWindow::location(ExecState* exec) const
 {
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    Location* location = impl()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, const_cast<JSDOMWindow*>(this)), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
+}
+
+void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
         return;
 
 #if ENABLE(DASHBOARD_SUPPORT)
     // To avoid breaking old widgets, make "var location =" in a top-level frame create
     // a property named "location" instead of performing a navigation (<rdar://problem/5688039>).
-    if (Settings* settings = activeFrame->settings()) {
-        if (settings->usesDashboardBackwardCompatibilityMode() && !activeFrame->tree()->parent()) {
+    if (Settings* settings = lexicalFrame->settings()) {
+        if (settings->usesDashboardBackwardCompatibilityMode() && !lexicalFrame->tree()->parent()) {
             if (allowsAccessFrom(exec))
                 putDirect(Identifier(exec, "location"), value);
             return;
@@ -142,85 +195,345 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValuePtr value)
     }
 #endif
 
-    if (!activeFrame->loader()->shouldAllowNavigation(impl()->frame()))
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    if (!shouldAllowNavigation(exec, frame))
         return;
-    String dstUrl = activeFrame->loader()->completeURL(value->toString(exec)).string();
-    if (!protocolIs(dstUrl, "javascript") || allowsAccessFrom(exec)) {
-        bool userGesture = activeFrame->script()->processingUserGesture();
+
+    KURL url = completeURL(exec, value.toString(exec));
+    if (url.isNull())
+        return;
+
+    if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        impl()->frame()->loader()->scheduleLocationChange(dstUrl, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+        frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
     }
 }
 
-JSValuePtr JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::crypto(ExecState*) const
 {
-    DOMWindow* window = impl();
-
-    DOMWindow* source = asJSDOMWindow(exec->dynamicGlobalObject())->impl();
-    String message = args.at(exec, 0)->toString(exec);
+    return jsUndefined();
+}
 
-    if (exec->hadException())
+JSValue JSDOMWindow::event(ExecState* exec) const
+{
+    Event* event = currentEvent();
+    if (!event)
         return jsUndefined();
+    return toJS(exec, event);
+}
 
-    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(exec, 1));
+JSValue JSDOMWindow::image(ExecState* exec) const
+{
+    return getDOMConstructor<JSImageConstructor>(exec, this);
+}
 
-    String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, (args.size() == 2) ? 1 : 2));
-    if (exec->hadException())
+JSValue JSDOMWindow::option(ExecState* exec) const
+{
+    return getDOMConstructor<JSOptionConstructor>(exec, this);
+}
+
+#if ENABLE(VIDEO)
+JSValue JSDOMWindow::audio(ExecState* exec) const
+{
+    if (!MediaPlayer::isAvailable())
         return jsUndefined();
+    return getDOMConstructor<JSAudioConstructor>(exec, this);
+}
+#endif
 
-    ExceptionCode ec = 0;
-    window->postMessage(message, messagePort, targetOrigin, source, ec);
-    setDOMException(exec, ec);
+JSValue JSDOMWindow::webKitPoint(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebKitPointConstructor>(exec);
+}
 
-    return jsUndefined();
+JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec);
+}
+ 
+JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
+{
+    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
+}
+
+#if ENABLE(XSLT)
+JSValue JSDOMWindow::xsltProcessor(ExecState* exec) const
+{
+    return getDOMConstructor<JSXSLTProcessorConstructor>(exec);
+}
+#endif
+
+#if ENABLE(CHANNEL_MESSAGING)
+JSValue JSDOMWindow::messageChannel(ExecState* exec) const
+{
+    return getDOMConstructor<JSMessageChannelConstructor>(exec, this);
+}
+#endif
+
+#if ENABLE(WORKERS)
+JSValue JSDOMWindow::worker(ExecState* exec) const
+{
+    return getDOMConstructor<JSWorkerConstructor>(exec);
+}
+#endif
+
+// Custom functions
+
+// Helper for window.open() and window.showModalDialog()
+static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicFrame,
+                           Frame* openerFrame, const String& url, const String& frameName, 
+                           const WindowFeatures& windowFeatures, JSValue dialogArgs)
+{
+    ASSERT(lexicalFrame);
+    ASSERT(dynamicFrame);
+
+    ResourceRequest request;
+
+    // For whatever reason, Firefox uses the dynamicGlobalObject to determine
+    // the outgoingReferrer.  We replicate that behavior here.
+    String referrer = dynamicFrame->loader()->outgoingReferrer();
+    request.setHTTPReferrer(referrer);
+    FrameLoader::addHTTPOriginIfNeeded(request, dynamicFrame->loader()->outgoingOrigin());
+    FrameLoadRequest frameRequest(request, frameName);
+
+    // FIXME: It's much better for client API if a new window starts with a URL, here where we
+    // know what URL we are going to open. Unfortunately, this code passes the empty string
+    // for the URL, but there's a reason for that. Before loading we have to set up the opener,
+    // openedByDOM, and dialogArguments values. Also, to decide whether to use the URL we currently
+    // do an allowsAccessFrom call using the window we create, which can't be done before creating it.
+    // We'd have to resolve all those issues to pass the URL instead of "".
+
+    bool created;
+    // We pass in the opener frame here so it can be used for looking up the frame name, in case the active frame
+    // is different from the opener frame, and the name references a frame relative to the opener frame, for example
+    // "_self" or "_parent".
+    Frame* newFrame = lexicalFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
+    if (!newFrame)
+        return 0;
+
+    newFrame->loader()->setOpener(openerFrame);
+    newFrame->loader()->setOpenedByDOM();
+
+    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
+
+    if (dialogArgs)
+        newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
+
+    if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
+        KURL completedURL = url.isEmpty() ? KURL("") : completeURL(exec, url);
+        bool userGesture = processingUserGesture(exec);
+
+        if (created)
+            newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
+        else if (!url.isEmpty())
+            newFrame->loader()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    }
+
+    return newFrame;
 }
 
-static JSValuePtr setTimeoutOrInterval(ExecState* exec, JSDOMWindow* window, const ArgList& args, bool timeout)
+JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr v = args.at(exec, 0);
-    int delay = args.at(exec, 1)->toInt32(exec);
-    if (v->isString())
-        return jsNumber(exec, window->installTimeout(asString(v)->value(), delay, timeout));
-    CallData callData;
-    if (v->getCallData(callData) == CallTypeNone)
+    Frame* frame = impl()->frame();
+    if (!frame)
         return jsUndefined();
-    ArgList argsTail;
-    args.getSlice(2, argsTail);
-    return jsNumber(exec, window->installTimeout(exec, v, argsTail, delay, timeout));
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return jsUndefined();
+    Frame* dynamicFrame = toDynamicFrame(exec);
+    if (!dynamicFrame)
+        return jsUndefined();
+
+    Page* page = frame->page();
+
+    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
+
+    // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
+    // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
+    if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
+        return jsUndefined();
+
+    // Get the target frame for the special cases of _top and _parent.  In those
+    // cases, we can schedule a location change right now and return early.
+    bool topOrParent = false;
+    if (frameName == "_top") {
+        frame = frame->tree()->top();
+        topOrParent = true;
+    } else if (frameName == "_parent") {
+        if (Frame* parent = frame->tree()->parent())
+            frame = parent;
+        topOrParent = true;
+    }
+    if (topOrParent) {
+        if (!shouldAllowNavigation(exec, frame))
+            return jsUndefined();
+
+        String completedURL;
+        if (!urlString.isEmpty())
+            completedURL = completeURL(exec, urlString).string();
+
+        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
+        if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
+            bool userGesture = processingUserGesture(exec);
+
+            // For whatever reason, Firefox uses the dynamicGlobalObject to
+            // determine the outgoingReferrer.  We replicate that behavior
+            // here.
+            String referrer = dynamicFrame->loader()->outgoingReferrer();
+
+            frame->loader()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+        }
+        return toJS(exec, frame->domWindow());
+    }
+
+    // In the case of a named frame or a new window, we'll use the createWindow() helper
+    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
+    FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
+                         windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
+    DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
+
+    windowFeatures.x = windowRect.x();
+    windowFeatures.y = windowRect.y();
+    windowFeatures.height = windowRect.height();
+    windowFeatures.width = windowRect.width();
+
+    frame = createWindow(exec, lexicalFrame, dynamicFrame, frame, urlString, frameName, windowFeatures, JSValue());
+
+    if (!frame)
+        return jsUndefined();
+
+    return toJS(exec, frame->domWindow());
 }
 
-JSValuePtr JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
 {
-    return setTimeoutOrInterval(exec, this, args, true);
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return jsUndefined();
+    Frame* dynamicFrame = toDynamicFrame(exec);
+    if (!dynamicFrame)
+        return jsUndefined();
+
+    if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
+        return jsUndefined();
+
+    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    JSValue dialogArgs = args.at(1);
+    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+
+    HashMap<String, String> features;
+    DOMWindow::parseModalDialogFeatures(featureArgs, features);
+
+    const bool trusted = false;
+
+    // The following features from Microsoft's documentation are not implemented:
+    // - default font settings
+    // - width, height, left, and top specified in units other than "px"
+    // - edge (sunken or raised, default is raised)
+    // - dialogHide: trusted && boolFeature(features, "dialoghide"), makes dialog hide when you print
+    // - help: boolFeature(features, "help", true), makes help icon appear in dialog (what does it do on Windows?)
+    // - unadorned: trusted && boolFeature(features, "unadorned");
+
+    FloatRect screenRect = screenAvailableRect(frame->view());
+
+    WindowFeatures wargs;
+    wargs.width = WindowFeatures::floatFeature(features, "dialogwidth", 100, screenRect.width(), 620); // default here came from frame size of dialog in MacIE
+    wargs.widthSet = true;
+    wargs.height = WindowFeatures::floatFeature(features, "dialogheight", 100, screenRect.height(), 450); // default here came from frame size of dialog in MacIE
+    wargs.heightSet = true;
+
+    wargs.x = WindowFeatures::floatFeature(features, "dialogleft", screenRect.x(), screenRect.right() - wargs.width, -1);
+    wargs.xSet = wargs.x > 0;
+    wargs.y = WindowFeatures::floatFeature(features, "dialogtop", screenRect.y(), screenRect.bottom() - wargs.height, -1);
+    wargs.ySet = wargs.y > 0;
+
+    if (WindowFeatures::boolFeature(features, "center", true)) {
+        if (!wargs.xSet) {
+            wargs.x = screenRect.x() + (screenRect.width() - wargs.width) / 2;
+            wargs.xSet = true;
+        }
+        if (!wargs.ySet) {
+            wargs.y = screenRect.y() + (screenRect.height() - wargs.height) / 2;
+            wargs.ySet = true;
+        }
+    }
+
+    wargs.dialog = true;
+    wargs.resizable = WindowFeatures::boolFeature(features, "resizable");
+    wargs.scrollbarsVisible = WindowFeatures::boolFeature(features, "scroll", true);
+    wargs.statusBarVisible = WindowFeatures::boolFeature(features, "status", !trusted);
+    wargs.menuBarVisible = false;
+    wargs.toolBarVisible = false;
+    wargs.locationBarVisible = false;
+    wargs.fullscreen = false;
+
+    Frame* dialogFrame = createWindow(exec, lexicalFrame, dynamicFrame, frame, url, "", wargs, dialogArgs);
+    if (!dialogFrame)
+        return jsUndefined();
+
+    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
+    dialogFrame->page()->chrome()->runModal();
+
+    return dialogWindow->getDirect(Identifier(exec, "returnValue"));
 }
 
-JSValuePtr JSDOMWindow::clearTimeout(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
 {
-    removeTimeout(args.at(exec, 0)->toInt32(exec));
+    DOMWindow* window = impl();
+
+    DOMWindow* source = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
+    String message = args.at(0).toString(exec);
+
+    if (exec->hadException())
+        return jsUndefined();
+
+    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(1));
+
+    String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at((args.size() == 2) ? 1 : 2));
+    if (exec->hadException())
+        return jsUndefined();
+
+    ExceptionCode ec = 0;
+    window->postMessage(message, messagePort, targetOrigin, source, ec);
+    setDOMException(exec, ec);
+
     return jsUndefined();
 }
 
-JSValuePtr JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 {
-    return setTimeoutOrInterval(exec, this, args, false);
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setTimeout(action, delay));
 }
 
-JSValuePtr JSDOMWindow::clearInterval(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
 {
-    removeTimeout(args.at(exec, 0)->toInt32(exec));
-    return jsUndefined();
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setInterval(action, delay));
 }
 
-JSValuePtr JSDOMWindow::atob(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::atob(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    JSValuePtr v = args.at(exec, 0);
-    if (v->isNull())
+    JSValue v = args.at(0);
+    if (v.isNull())
         return jsEmptyString(exec);
 
-    UString s = v->toString(exec);
+    UString s = v.toString(exec);
     if (!s.is8Bit()) {
         setDOMException(exec, INVALID_CHARACTER_ERR);
         return jsUndefined();
@@ -237,16 +550,16 @@ JSValuePtr JSDOMWindow::atob(ExecState* exec, const ArgList& args)
     return jsString(exec, String(out.data(), out.size()));
 }
 
-JSValuePtr JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    JSValuePtr v = args.at(exec, 0);
-    if (v->isNull())
+    JSValue v = args.at(0);
+    if (v.isNull())
         return jsEmptyString(exec);
 
-    UString s = v->toString(exec);
+    UString s = v.toString(exec);
     if (!s.is8Bit()) {
         setDOMException(exec, INVALID_CHARACTER_ERR);
         return jsUndefined();
@@ -262,37 +575,33 @@ JSValuePtr JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
     return jsString(exec, String(out.data(), out.size()));
 }
 
-JSValuePtr JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(exec, args.at(exec, 1))) {
-        if (Document* doc = frame->document())
-            doc->addWindowEventListener(AtomicString(args.at(exec, 0)->toString(exec)), listener.release(), args.at(exec, 2)->toBoolean(exec));
-    }
+    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(AtomicString(args.at(0).toString(exec)), listener.release(), args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-JSValuePtr JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    if (JSEventListener* listener = findJSEventListener(args.at(exec, 1))) {
-        if (Document* doc = frame->document())
-            doc->removeWindowEventListener(AtomicString(args.at(exec, 0)->toString(exec)), listener, args.at(exec, 2)->toBoolean(exec));
-    }
+    if (JSEventListener* listener = findJSEventListener(args.at(1)))
+        impl()->removeEventListener(AtomicString(args.at(0).toString(exec)), listener, args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-DOMWindow* toDOMWindow(JSValuePtr value)
+DOMWindow* toDOMWindow(JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
     if (object->inherits(&JSDOMWindow::s_info))
@@ -302,24 +611,4 @@ DOMWindow* toDOMWindow(JSValuePtr value)
     return 0;
 }
 
-JSValuePtr nonCachingStaticCloseFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionClose);
-}
-
-JSValuePtr nonCachingStaticBlurFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionBlur);
-}
-
-JSValuePtr nonCachingStaticFocusFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionFocus);
-}
-
-JSValuePtr nonCachingStaticPostMessageFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 2, propertyName, jsDOMWindowPrototypeFunctionPostMessage);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
index 838abab..52ef4a0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2008, 2009 Apple Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -21,6 +21,7 @@
 
 #include "JSDOMWindow.h"
 #include "JSDOMWindowShell.h"
+#include <runtime/PrototypeFunction.h>
 #include <wtf/AlwaysInline.h>
 
 namespace WebCore {
@@ -35,10 +36,11 @@ inline const JSDOMWindow* asJSDOMWindow(const JSC::JSGlobalObject* globalObject)
     return static_cast<const JSDOMWindow*>(globalObject);
 }
 
-JSC::JSValuePtr nonCachingStaticCloseFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticBlurFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticFocusFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticPostMessageFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+template<JSC::NativeFunction nativeFunction, int length>
+JSC::JSValue nonCachingStaticFunctionGetter(JSC::ExecState* exec, const JSC::Identifier& propertyName, const JSC::PropertySlot&)
+{
+    return new (exec) JSC::PrototypeFunction(exec, length, propertyName, nativeFunction);
+}
 
 ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
 {
@@ -59,7 +61,7 @@ ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, c
         }
         entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
         if (entry && (entry->attributes() & JSC::Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
-            slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
             return true;
         }
 
@@ -74,12 +76,10 @@ ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, c
     // is allowed.
     bool allowsAccess = allowsAccessFromNoErrorMessage(exec);
 
-    // Look for overrides before looking at any of our own properties.
-    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot)) {
-        // But ignore overrides completely if this is cross-domain access.
-        if (allowsAccess)
-            return true;
-    }
+    // Look for overrides before looking at any of our own properties, but ignore overrides completely
+    // if this is cross-domain access.
+    if (allowsAccess && JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
+        return true;
 
     // We need this code here because otherwise JSC::Window will stop the search before we even get to the
     // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
@@ -90,22 +90,27 @@ ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, c
         if (entry->attributes() & JSC::Function) {
             if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticBlurFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
                     return true;
                 }
             } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
                     return true;
                 }
             } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticFocusFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
                     return true;
                 }
             } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
                 if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticPostMessageFunctionGetter);
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    slot.setUndefined();
                     return true;
                 }
             }
@@ -123,12 +128,12 @@ ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, c
     return false;
 }
 
-inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::JSValuePtr value, JSC::PutPropertySlot& slot)
+inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::JSValue value, JSC::PutPropertySlot& slot)
 {
     if (!impl()->frame())
         return true;
 
-    // We have a local override (e.g. "var location"), save time and jump directly to JSGlobalObject.
+    // Optimization: access JavaScript global variables directly before involving the DOM.
     JSC::PropertySlot getSlot;
     bool slotIsWriteable;
     if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, getSlot, slotIsWriteable)) {
@@ -146,8 +151,6 @@ inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier&
     return false;
 }
 
-
-
 inline bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
 {
     if (allowsAccessFromPrivate(other))
@@ -156,7 +159,7 @@ inline bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
     return false;
 }
 
-    inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec) const
+inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec) const
 {
     if (allowsAccessFromPrivate(exec->lexicalGlobalObject()))
         return true;
@@ -185,12 +188,6 @@ ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const JSGlobalObject
     if (originWindow == targetWindow)
         return true;
 
-    // JS may be attempting to access the "window" object, which should be valid,
-    // even if the document hasn't been constructed yet.  If the document doesn't
-    // exist yet allow JS to access the window object.
-    if (!originWindow->impl()->document())
-        return true;
-
     const SecurityOrigin* originSecurityOrigin = originWindow->impl()->securityOrigin();
     const SecurityOrigin* targetSecurityOrigin = targetWindow->impl()->securityOrigin();
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index d54611e..1bf478b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
 
@@ -54,11 +54,17 @@ JSDOMWindowShell::~JSDOMWindowShell()
 {
 }
 
-void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> window)
+void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
 {
+    // Explicitly protect the global object's prototype so it isn't collected
+    // when we allocate the global object. (Once the global object is fully
+    // constructed, it can mark its own prototype.)
     RefPtr<Structure> prototypeStructure = JSDOMWindowPrototype::createStructure(jsNull());
-    RefPtr<Structure> structure = JSDOMWindow::createStructure(new JSDOMWindowPrototype(prototypeStructure.release()));
-    setWindow(new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), window, this));
+    ProtectedPtr<JSDOMWindowPrototype> prototype = new JSDOMWindowPrototype(prototypeStructure.release());
+
+    RefPtr<Structure> structure = JSDOMWindow::createStructure(prototype);
+    JSDOMWindow* jsDOMWindow = new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), domWindow, this);
+    setWindow(jsDOMWindow);
 }
 
 // ----
@@ -82,12 +88,12 @@ bool JSDOMWindowShell::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return m_window->getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_window->put(exec, propertyName, value, slot);
 }
 
-void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
@@ -117,12 +123,12 @@ void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyN
     m_window->defineSetter(exec, propertyName, setterFunction);
 }
 
-JSValuePtr JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->lookupGetter(exec, propertyName);
 }
 
-JSValuePtr JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->lookupSetter(exec, propertyName);
 }
@@ -141,16 +147,6 @@ DOMWindow* JSDOMWindowShell::impl() const
     return m_window->impl();
 }
 
-void JSDOMWindowShell::disconnectFrame()
-{
-    m_window->disconnectFrame();
-}
-
-void JSDOMWindowShell::clear()
-{
-    m_window->clear();
-}
-
 void* JSDOMWindowShell::operator new(size_t size)
 {
     return JSDOMWindow::commonJSGlobalData()->heap.allocate(size);
@@ -160,7 +156,7 @@ void* JSDOMWindowShell::operator new(size_t size)
 // Conversion methods
 // ----
 
-JSValuePtr toJS(ExecState*, Frame* frame)
+JSValue toJS(ExecState*, Frame* frame)
 {
     if (!frame)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 931a256..6f21892 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -55,12 +55,10 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
         DOMWindow* impl() const;
-        void disconnectFrame();
-        void clear();
 
         void* operator new(size_t);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType)); 
         }
@@ -69,22 +67,22 @@ namespace WebCore {
         virtual void mark();
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, unsigned attributes);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
-        virtual JSC::JSValuePtr lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
-        virtual JSC::JSValuePtr lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSObject* unwrappedObject();
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
         JSDOMWindow* m_window;
     };
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, Frame*);
+    JSC::JSValue toJS(JSC::ExecState*, Frame*);
     JSDOMWindowShell* toJSDOMWindowShell(Frame*);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
index 68639d5..af3b066 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JSDatabase.h"
 
+#if ENABLE(DATABASE)
+
 #include "DOMWindow.h"
 #include "Database.h"
 #include "Document.h"
@@ -45,17 +47,17 @@ namespace WebCore {
 
 using namespace JSC;
 
-JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
+JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
 {
-    String oldVersion = args.at(exec, 0)->toString(exec);
-    String newVersion = args.at(exec, 1)->toString(exec);
+    String oldVersion = args.at(0).toString(exec);
+    String newVersion = args.at(1).toString(exec);
 
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
     
-    JSObject *object;
-    if (!(object = args.at(exec, 2)->getObject())) {
+    JSObject* object;
+    if (!(object = args.at(2).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }
@@ -63,8 +65,8 @@ JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
     
     RefPtr<SQLTransactionErrorCallback> errorCallback;
-    if (!args.at(exec, 3)->isNull()) {
-        if (!(object = args.at(exec, 3)->getObject())) {
+    if (!args.at(3).isNull()) {
+        if (!(object = args.at(3).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
@@ -73,8 +75,8 @@ JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     }
     
     RefPtr<VoidCallback> successCallback;
-    if (!args.at(exec, 4)->isNull()) {
-        successCallback = toVoidCallback(exec, args.at(exec, 4));
+    if (!args.at(4).isNull()) {
+        successCallback = toVoidCallback(exec, args.at(4));
         if (!successCallback) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -86,11 +88,11 @@ JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
+JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
 {
     JSObject* object;
     
-    if (!(object = args.at(exec, 0)->getObject())) {
+    if (!(object = args.at(0).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }        
@@ -102,8 +104,8 @@ JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
     RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     
-    if (args.size() > 1 && !args.at(exec, 1)->isNull()) {
-        if (!(object = args.at(exec, 1)->getObject())) {
+    if (args.size() > 1 && !args.at(1).isNull()) {
+        if (!(object = args.at(1).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
@@ -112,8 +114,8 @@ JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
     }
 
     RefPtr<VoidCallback> successCallback;
-    if (args.size() > 2 && !args.at(exec, 2)->isNull()) {
-        successCallback = toVoidCallback(exec, args.at(exec, 2));
+    if (args.size() > 2 && !args.at(2).isNull()) {
+        successCallback = toVoidCallback(exec, args.at(2));
         if (!successCallback) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -126,3 +128,4 @@ JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
 }
     
 }
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index f292b38..956327a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -20,7 +20,6 @@
 #include "config.h"
 #include "JSDocument.h"
 
-#include "DOMWindow.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -28,9 +27,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
 #include "JSLocation.h"
-#include "JSNodeList.h"
 #include "Location.h"
-#include "NodeList.h"
 #include "ScriptController.h"
 
 #if ENABLE(SVG)
@@ -44,27 +41,34 @@ namespace WebCore {
 
 void JSDocument::mark()
 {
-    JSEventTargetNode::mark();
+    JSNode::mark();
     markDOMNodesForDocument(impl());
     markActiveObjectsForContext(*Heap::heap(this)->globalData(), impl());
 }
 
-JSValuePtr JSDocument::location(ExecState* exec) const
+JSValue JSDocument::location(ExecState* exec) const
 {
     Frame* frame = static_cast<Document*>(impl())->frame();
     if (!frame)
         return jsNull();
 
-    return toJS(exec, frame->domWindow()->location());
+    Location* location = frame->domWindow()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSDOMWindow* window = static_cast<JSDOMWindow*>(exec->lexicalGlobalObject());
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
 }
 
-void JSDocument::setLocation(ExecState* exec, JSValuePtr value)
+void JSDocument::setLocation(ExecState* exec, JSValue value)
 {
     Frame* frame = static_cast<Document*>(impl())->frame();
     if (!frame)
         return;
 
-    String str = value->toString(exec);
+    String str = value.toString(exec);
 
     // IE and Mozilla both resolve the URL relative to the source frame,
     // not the target frame.
@@ -73,10 +77,10 @@ void JSDocument::setLocation(ExecState* exec, JSValuePtr value)
         str = activeFrame->document()->completeURL(str).string();
 
     bool userGesture = activeFrame->script()->processingUserGesture();
-    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
-JSValuePtr toJS(ExecState* exec, Document* document)
+JSValue toJS(ExecState* exec, Document* document)
 {
     if (!document)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
index 3effe85..b12c185 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
@@ -53,7 +53,7 @@ using namespace HTMLNames;
 
 static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
-    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIs(parseURL(value), "javascript")) {
+    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(parseURL(value))) {
         HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
         if (!checkNodeSecurity(exec, frame->contentDocument()))
             return false;
@@ -61,11 +61,11 @@ static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* elem
     return true;
 } 
 
-JSValuePtr JSElement::setAttribute(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    AtomicString name = args.at(exec, 0)->toString(exec);
-    AtomicString value = args.at(exec, 1)->toString(exec);
+    AtomicString name = args.at(0).toString(exec);
+    AtomicString value = args.at(1).toString(exec);
 
     Element* imp = impl();
     if (!allowSettingSrcToJavascriptURL(exec, imp, name, value))
@@ -76,10 +76,10 @@ JSValuePtr JSElement::setAttribute(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    Attr* newAttr = toAttr(args.at(exec, 0));
+    Attr* newAttr = toAttr(args.at(0));
     if (!newAttr) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -89,17 +89,17 @@ JSValuePtr JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
     if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
         return jsUndefined();
 
-    JSValuePtr result = toJS(exec, WTF::getPtr(imp->setAttributeNode(newAttr, ec)));
+    JSValue result = toJS(exec, WTF::getPtr(imp->setAttributeNode(newAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    AtomicString namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    AtomicString qualifiedName = args.at(exec, 1)->toString(exec);
-    AtomicString value = args.at(exec, 2)->toString(exec);
+    AtomicString namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    AtomicString qualifiedName = args.at(1).toString(exec);
+    AtomicString value = args.at(2).toString(exec);
 
     Element* imp = impl();
     if (!allowSettingSrcToJavascriptURL(exec, imp, qualifiedName, value))
@@ -110,10 +110,10 @@ JSValuePtr JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    Attr* newAttr = toAttr(args.at(exec, 0));
+    Attr* newAttr = toAttr(args.at(0));
     if (!newAttr) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -123,12 +123,12 @@ JSValuePtr JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
     if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
         return jsUndefined();
 
-    JSValuePtr result = toJS(exec, WTF::getPtr(imp->setAttributeNodeNS(newAttr, ec)));
+    JSValue result = toJS(exec, WTF::getPtr(imp->setAttributeNodeNS(newAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr toJSNewlyCreated(ExecState* exec, Element* element)
+JSValue toJSNewlyCreated(ExecState* exec, Element* element)
 {
     if (!element)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index 1c59f9d..03b97d8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -72,12 +72,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSEvent::clipboardData(ExecState* exec) const
+JSValue JSEvent::clipboardData(ExecState* exec) const
 {
     return impl()->isClipboardEvent() ? toJS(exec, impl()->clipboardData()) : jsUndefined();
 }
 
-JSValuePtr toJS(ExecState* exec, Event* event)
+JSValue toJS(ExecState* exec, Event* event)
 {
     JSLock lock(false);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index f84e537..b9ed685 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -20,19 +20,10 @@
 #include "config.h"
 #include "JSEventListener.h"
 
-#include "CString.h"
-#include "Console.h"
-#include "DOMWindow.h"
-#include "Document.h"
 #include "Event.h"
 #include "Frame.h"
-#include "FrameLoader.h"
-#include "JSDOMWindow.h"
 #include "JSEvent.h"
 #include "JSEventTarget.h"
-#include "JSEventTargetNode.h"
-#include "ScriptController.h"
-#include <runtime/FunctionConstructor.h>
 #include <runtime/JSLock.h>
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -40,17 +31,43 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSAbstractEventListener)
+JSEventListener::JSEventListener(JSObject* function, JSDOMGlobalObject* globalObject, bool isAttribute)
+    : m_jsFunction(function)
+    , m_globalObject(globalObject)
+    , m_isAttribute(isAttribute)
+{
+    if (!m_isAttribute && m_jsFunction)
+        globalObject->jsEventListeners().set(m_jsFunction, this);
+}
+
+JSEventListener::~JSEventListener()
+{
+    if (!m_isAttribute && m_jsFunction && m_globalObject)
+        m_globalObject->jsEventListeners().remove(m_jsFunction);
+}
+
+JSObject* JSEventListener::jsFunction() const
+{
+    return m_jsFunction;
+}
+
+void JSEventListener::markJSFunction()
+{
+    if (m_jsFunction && !m_jsFunction->marked())
+        m_jsFunction->mark();
+    if (m_globalObject && !m_globalObject->marked())
+        m_globalObject->mark();
+}
 
-void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
+void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
 {
     JSLock lock(false);
 
-    JSObject* listener = listenerObj();
-    if (!listener)
+    JSObject* jsFunction = this->jsFunction();
+    if (!jsFunction)
         return;
 
-    JSDOMGlobalObject* globalObject = this->globalObject();
+    JSDOMGlobalObject* globalObject = m_globalObject;
     // Null check as clearGlobalObject() can clear this and we still get called back by
     // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
     // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
@@ -78,18 +95,18 @@ void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
 
     ExecState* exec = globalObject->globalExec();
 
-    JSValuePtr handleEventFunction = listener->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = handleEventFunction->getCallData(callData);
+    CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
-        handleEventFunction = noValue();
-        callType = listener->getCallData(callData);
+        handleEventFunction = JSValue();
+        callType = jsFunction->getCallData(callData);
     }
 
     if (callType != CallTypeNone) {
         ref();
 
-        ArgList args;
+        MarkedArgumentBuffer args;
         args.append(toJS(exec, event));
 
         Event* savedEvent = globalObject->currentEvent();
@@ -101,240 +118,44 @@ void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
-        JSValuePtr retval;
+        JSValue retval;
         if (handleEventFunction) {
-            globalObject->startTimeoutCheck();
-            retval = call(exec, handleEventFunction, callType, callData, listener, args);
+            globalObject->globalData()->timeoutChecker.start();
+            retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
         } else {
-            JSValuePtr thisValue;
+            JSValue thisValue;
             if (isWindowEvent)
                 thisValue = globalObject->toThisObject(exec);
             else
                 thisValue = toJS(exec, event->currentTarget());
-            globalObject->startTimeoutCheck();
-            retval = call(exec, listener, callType, callData, thisValue, args);
+            globalObject->globalData()->timeoutChecker.start();
+            retval = call(exec, jsFunction, callType, callData, thisValue, args);
         }
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
 
         if (exec->hadException())
             reportCurrentException(exec);
         else {
-            if (!retval->isUndefinedOrNull() && event->storesResultAsString())
-                event->storeResult(retval->toString(exec));
-            if (m_isInline) {
+            if (!retval.isUndefinedOrNull() && event->storesResultAsString())
+                event->storeResult(retval.toString(exec));
+            if (m_isAttribute) {
                 bool retvalbool;
-                if (retval->getBoolean(retvalbool) && !retvalbool)
+                if (retval.getBoolean(retvalbool) && !retvalbool)
                     event->preventDefault();
             }
         }
 
         if (scriptExecutionContext->isDocument())
-            Document::updateDocumentsRendering();
+            Document::updateStyleForAllDocuments();
         deref();
     }
 }
 
-bool JSAbstractEventListener::isInline() const
-{
-    return m_isInline;
-}
-
-// -------------------------------------------------------------------------
-
-JSUnprotectedEventListener::JSUnprotectedEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-    : JSAbstractEventListener(isInline)
-    , m_listener(listener)
-    , m_globalObject(globalObject)
-{
-    if (m_listener) {
-        JSDOMWindow::UnprotectedListenersMap& listeners = isInline
-            ? globalObject->jsUnprotectedInlineEventListeners() : globalObject->jsUnprotectedEventListeners();
-        listeners.set(m_listener, this);
-    }
-}
-
-JSUnprotectedEventListener::~JSUnprotectedEventListener()
+bool JSEventListener::virtualisAttribute() const
 {
-    if (m_listener && m_globalObject) {
-        JSDOMWindow::UnprotectedListenersMap& listeners = isInline()
-            ? m_globalObject->jsUnprotectedInlineEventListeners() : m_globalObject->jsUnprotectedEventListeners();
-        listeners.remove(m_listener);
-    }
-}
-
-JSObject* JSUnprotectedEventListener::listenerObj() const
-{
-    return m_listener;
-}
-
-JSDOMGlobalObject* JSUnprotectedEventListener::globalObject() const
-{
-    return m_globalObject;
-}
-
-void JSUnprotectedEventListener::clearGlobalObject()
-{
-    m_globalObject = 0;
-}
-
-void JSUnprotectedEventListener::mark()
-{
-    if (m_listener && !m_listener->marked())
-        m_listener->mark();
-}
-
-#ifndef NDEBUG
-static WTF::RefCountedLeakCounter eventListenerCounter("EventListener");
-#endif
-
-// -------------------------------------------------------------------------
-
-JSEventListener::JSEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-    : JSAbstractEventListener(isInline)
-    , m_listener(listener)
-    , m_globalObject(globalObject)
-{
-    if (m_listener) {
-        JSDOMWindow::ListenersMap& listeners = isInline
-            ? m_globalObject->jsInlineEventListeners() : m_globalObject->jsEventListeners();
-        listeners.set(m_listener, this);
-    }
-#ifndef NDEBUG
-    eventListenerCounter.increment();
-#endif
-}
-
-JSEventListener::~JSEventListener()
-{
-    if (m_listener && m_globalObject) {
-        JSDOMWindow::ListenersMap& listeners = isInline()
-            ? m_globalObject->jsInlineEventListeners() : m_globalObject->jsEventListeners();
-        listeners.remove(m_listener);
-    }
-#ifndef NDEBUG
-    eventListenerCounter.decrement();
-#endif
-}
-
-JSObject* JSEventListener::listenerObj() const
-{
-    return m_listener;
-}
-
-JSDOMGlobalObject* JSEventListener::globalObject() const
-{
-    return m_globalObject;
-}
-
-void JSEventListener::clearGlobalObject()
-{
-    m_globalObject = 0;
-}
-
-// -------------------------------------------------------------------------
-
-JSLazyEventListener::JSLazyEventListener(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-    : JSEventListener(0, globalObject, true)
-    , m_functionName(functionName)
-    , m_code(code)
-    , m_parsed(false)
-    , m_lineNumber(lineNumber)
-    , m_originalNode(node)
-    , m_type(type)
-{
-    // We don't retain the original node because we assume it
-    // will stay alive as long as this handler object is around
-    // and we need to avoid a reference cycle. If JS transfers
-    // this handler to another node, parseCode will be called and
-    // then originalNode is no longer needed.
-
-    // A JSLazyEventListener can be created with a line number of zero when it is created with
-    // a setAttribute call from JavaScript, so make the line number 1 in that case.
-    if (m_lineNumber == 0)
-        m_lineNumber = 1;
-}
-
-JSObject* JSLazyEventListener::listenerObj() const
-{
-    parseCode();
-    return m_listener;
-}
-
-// Helper function
-inline JSValuePtr eventParameterName(JSLazyEventListener::LazyEventListenerType type, ExecState* exec)
-{
-    switch (type) {
-    case JSLazyEventListener::HTMLLazyEventListener:
-        return jsNontrivialString(exec, "event");
-#if ENABLE(SVG)
-    case JSLazyEventListener::SVGLazyEventListener:
-        return jsNontrivialString(exec, "evt");
-#endif
-    default:
-        ASSERT_NOT_REACHED();
-        return jsUndefined();
-    }
-}
-
-void JSLazyEventListener::parseCode() const
-{
-    if (m_parsed)
-        return;
-
-    if (globalObject()->scriptExecutionContext()->isDocument()) {
-        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject());
-        Frame* frame = window->impl()->frame();
-        if (!frame)
-            return;
-        // FIXME: Is this check needed for non-Document contexts?
-        ScriptController* script = frame->script();
-        if (!script->isEnabled() || script->isPaused())
-            return;
-    }
-
-    m_parsed = true;
-
-    ExecState* exec = globalObject()->globalExec();
-
-    ArgList args;
-    UString sourceURL(globalObject()->scriptExecutionContext()->url().string());
-    args.append(eventParameterName(m_type, exec));
-    args.append(jsString(exec, m_code));
-
-    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
-    // have been added with setAttribute from a script, and we should pass String() in that case.
-    m_listener = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
-
-    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_listener.get());
-
-    if (exec->hadException()) {
-        exec->clearException();
-
-        // failed to parse, so let's just make this listener a no-op
-        m_listener = 0;
-    } else if (m_originalNode) {
-        // Add the event's home element to the scope
-        // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
-        ScopeChain scope = listenerAsFunction->scope();
-
-        JSValuePtr thisObj = toJS(exec, m_originalNode);
-        if (thisObj->isObject()) {
-            static_cast<JSEventTargetNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
-            listenerAsFunction->setScope(scope);
-        }
-    }
-
-    // no more need to keep the unparsed code around
-    m_functionName = String();
-    m_code = String();
-
-    if (m_listener) {
-        ASSERT(isInline());
-        JSDOMWindow::ListenersMap& listeners = globalObject()->jsInlineEventListeners();
-        listeners.set(m_listener, const_cast<JSLazyEventListener*>(this));
-    }
+    return m_isAttribute;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index 859d5d4..ce34832 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -21,103 +21,39 @@
 #define JSEventListener_h
 
 #include "EventListener.h"
-#include "PlatformString.h"
+#include "JSDOMWindow.h"
 #include <runtime/Protect.h>
 
 namespace WebCore {
 
-    class Event;
     class JSDOMGlobalObject;
-    class Node;
 
-    class JSAbstractEventListener : public EventListener {
+    class JSEventListener : public EventListener {
     public:
-        virtual void handleEvent(Event*, bool isWindowEvent);
-        virtual bool isInline() const;
-        virtual JSC::JSObject* listenerObj() const = 0;
-        virtual JSDOMGlobalObject* globalObject() const = 0;
-
-    protected:
-        JSAbstractEventListener(bool isInline)
-            : m_isInline(isInline)
-        {
-        }
-
-    private:
-        bool m_isInline;
-    };
-
-    class JSUnprotectedEventListener : public JSAbstractEventListener {
-    public:
-        static PassRefPtr<JSUnprotectedEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-        {
-            return adoptRef(new JSUnprotectedEventListener(listener, globalObject, isInline));
-        }
-        virtual ~JSUnprotectedEventListener();
-
-        virtual JSC::JSObject* listenerObj() const;
-        virtual JSDOMGlobalObject* globalObject() const;
-        void clearGlobalObject();
-        void mark();
-
-    private:
-        JSUnprotectedEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
-
-        JSC::JSObject* m_listener;
-        JSDOMGlobalObject* m_globalObject;
-    };
-
-    class JSEventListener : public JSAbstractEventListener {
-    public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isAttribute)
         {
-            return adoptRef(new JSEventListener(listener, globalObject, isInline));
+            return adoptRef(new JSEventListener(listener, globalObject, isAttribute));
         }
         virtual ~JSEventListener();
+        void clearGlobalObject() { m_globalObject = 0; }
 
-        virtual JSC::JSObject* listenerObj() const;
-        virtual JSDOMGlobalObject* globalObject() const;
-        void clearGlobalObject();
-
-    protected:
-        JSEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
+        // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
+        bool isAttribute() const { return m_isAttribute; }
 
-        mutable JSC::ProtectedPtr<JSC::JSObject> m_listener;
+        virtual JSC::JSObject* jsFunction() const;
 
     private:
-        JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-    };
-
-    class JSLazyEventListener : public JSEventListener {
-    public:
-        enum LazyEventListenerType {
-            HTMLLazyEventListener
-#if ENABLE(SVG)
-            , SVGLazyEventListener
-#endif
-        };
-
-        virtual bool wasCreatedFromMarkup() const { return true; }
-
-        static PassRefPtr<JSLazyEventListener> create(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-        {
-            return adoptRef(new JSLazyEventListener(type, functionName, code, globalObject, node, lineNumber));
-        }
-        virtual JSC::JSObject* listenerObj() const;
+        virtual void markJSFunction();
+        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual bool virtualisAttribute() const;
+        void clearJSFunctionInline();
 
     protected:
-        JSLazyEventListener(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+        JSEventListener(JSC::JSObject* function, JSDOMGlobalObject*, bool isAttribute);
 
-    private:
-        void parseCode() const;
-
-        mutable String m_functionName;
-        mutable String m_code;
-        mutable bool m_parsed;
-        int m_lineNumber;
-        Node* m_originalNode;
-
-        LazyEventListenerType m_type;
+        mutable JSC::JSObject* m_jsFunction;
+        JSDOMGlobalObject* m_globalObject;
+        bool m_isAttribute;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
index 8239897..2058098 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
@@ -26,26 +26,41 @@
 #include "config.h"
 #include "JSEventTarget.h"
 
+#include "DOMWindow.h"
 #include "Document.h"
+#include "JSDOMWindow.h"
+#include "JSDOMWindowShell.h"
 #include "JSEventListener.h"
-#include "JSEventTargetNode.h"
 #include "JSMessagePort.h"
-#include "JSWorker.h"
-#include "JSWorkerContext.h"
+#include "JSNode.h"
+#include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestUpload.h"
-#include "Worker.h"
-#include "WorkerContext.h"
+#include "MessagePort.h"
+#include "XMLHttpRequest.h"
+#include "XMLHttpRequestUpload.h"
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "DOMApplicationCache.h"
+#include "JSDOMApplicationCache.h"
+#endif
 
 #if ENABLE(SVG)
 #include "SVGElementInstance.h"
 #include "JSSVGElementInstance.h"
 #endif
 
+#if ENABLE(WORKERS)
+#include "JSWorker.h"
+#include "JSWorkerContext.h"
+#include "Worker.h"
+#include "WorkerContext.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, EventTarget* target)
+JSValue toJS(ExecState* exec, EventTarget* target)
 {
     if (!target)
         return jsNull();
@@ -59,6 +74,9 @@ JSValuePtr toJS(ExecState* exec, EventTarget* target)
     if (Node* node = target->toNode())
         return toJS(exec, node);
 
+    if (DOMWindow* domWindow = target->toDOMWindow())
+        return toJS(exec, domWindow);
+
     if (XMLHttpRequest* xhr = target->toXMLHttpRequest())
         // XMLHttpRequest is always created via JS, so we don't need to use cacheDOMObject() here.
         return getCachedDOMObjectWrapper(exec->globalData(), xhr);
@@ -87,4 +105,34 @@ JSValuePtr toJS(ExecState* exec, EventTarget* target)
     return jsNull();
 }
 
+EventTarget* toEventTarget(JSC::JSValue value)
+{
+    #define CONVERT_TO_EVENT_TARGET(type) \
+        if (value.isObject(&JS##type::s_info)) \
+            return static_cast<JS##type*>(asObject(value))->impl();
+
+    CONVERT_TO_EVENT_TARGET(Node)
+    CONVERT_TO_EVENT_TARGET(XMLHttpRequest)
+    CONVERT_TO_EVENT_TARGET(XMLHttpRequestUpload)
+    CONVERT_TO_EVENT_TARGET(MessagePort)
+
+    if (value.isObject(&JSDOMWindowShell::s_info))
+        return static_cast<JSDOMWindowShell*>(asObject(value))->impl();
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    CONVERT_TO_EVENT_TARGET(DOMApplicationCache)
+#endif
+
+#if ENABLE(SVG)
+    CONVERT_TO_EVENT_TARGET(SVGElementInstance)
+#endif
+
+#if ENABLE(WORKERS)
+    CONVERT_TO_EVENT_TARGET(Worker)
+    CONVERT_TO_EVENT_TARGET(WorkerContext)
+#endif
+
+    return 0;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h
index 00dd848..05df056 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h
@@ -36,7 +36,8 @@ namespace WebCore {
 
     class EventTarget;
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, EventTarget*);
+    JSC::JSValue toJS(JSC::ExecState*, EventTarget*);
+    EventTarget* toEventTarget(JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetBase.h
deleted file mode 100644
index 2aa2bf2..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetBase.h
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSEventTargetBase_h
-#define JSEventTargetBase_h
-
-#include "Event.h"
-#include "EventNames.h"
-#include "JSEvent.h"
-
-#define JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, macro) \
-    macro(specificEventTarget, OnAbort, abortEvent) \
-    macro(specificEventTarget, OnBlur, blurEvent) \
-    macro(specificEventTarget, OnChange, changeEvent) \
-    macro(specificEventTarget, OnClick, clickEvent) \
-    macro(specificEventTarget, OnContextMenu, contextmenuEvent) \
-    macro(specificEventTarget, OnDblClick, dblclickEvent) \
-    macro(specificEventTarget, OnError, errorEvent) \
-    macro(specificEventTarget, OnFocus, focusEvent) \
-    macro(specificEventTarget, OnInput, inputEvent) \
-    macro(specificEventTarget, OnKeyDown, keydownEvent) \
-    macro(specificEventTarget, OnKeyPress, keypressEvent) \
-    macro(specificEventTarget, OnKeyUp, keyupEvent) \
-    macro(specificEventTarget, OnLoad, loadEvent) \
-    macro(specificEventTarget, OnMouseDown, mousedownEvent) \
-    macro(specificEventTarget, OnMouseMove, mousemoveEvent) \
-    macro(specificEventTarget, OnMouseOut, mouseoutEvent) \
-    macro(specificEventTarget, OnMouseOver, mouseoverEvent) \
-    macro(specificEventTarget, OnMouseUp, mouseupEvent) \
-    macro(specificEventTarget, OnMouseWheel, mousewheelEvent) \
-    macro(specificEventTarget, OnBeforeCut, beforecutEvent) \
-    macro(specificEventTarget, OnCut, cutEvent) \
-    macro(specificEventTarget, OnBeforeCopy, beforecopyEvent) \
-    macro(specificEventTarget, OnCopy, copyEvent) \
-    macro(specificEventTarget, OnBeforePaste, beforepasteEvent) \
-    macro(specificEventTarget, OnPaste, pasteEvent) \
-    macro(specificEventTarget, OnDragEnter, dragenterEvent) \
-    macro(specificEventTarget, OnDragOver, dragoverEvent) \
-    macro(specificEventTarget, OnDragLeave, dragleaveEvent) \
-    macro(specificEventTarget, OnDrop, dropEvent) \
-    macro(specificEventTarget, OnDragStart, dragstartEvent) \
-    macro(specificEventTarget, OnDrag, dragEvent) \
-    macro(specificEventTarget, OnDragEnd, dragendEvent) \
-    macro(specificEventTarget, OnReset, resetEvent) \
-    macro(specificEventTarget, OnResize, resizeEvent) \
-    macro(specificEventTarget, OnScroll, scrollEvent) \
-    macro(specificEventTarget, OnSearch, searchEvent) \
-    macro(specificEventTarget, OnSelect, selectEvent) \
-    macro(specificEventTarget, OnSelectStart, selectstartEvent) \
-    macro(specificEventTarget, OnSubmit, submitEvent) \
-    macro(specificEventTarget, OnUnload, unloadEvent) \
-
-#define EVENT_LISTENER_GETTER(specificEventTarget, name, event) \
-JSC::JSValuePtr js##specificEventTarget##name(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot& slot) \
-{ \
-    return static_cast<JS##specificEventTarget*>(slot.slotBase())->getListener(event); \
-} \
-
-#define EVENT_LISTENER_SETTER(specificEventTarget, name, event) \
-void setJS##specificEventTarget##name(JSC::ExecState* exec, JSC::JSObject* baseObject, JSC::JSValuePtr value) \
-{ \
-    static_cast<JS##specificEventTarget*>(baseObject)->setListener(exec, event, value); \
-} \
-
-#define DECLARE_JS_EVENT_LISTENERS(specificEventTarget) \
-    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_GETTER) \
-    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_SETTER) \
-
-#endif // JSEventTargetBase_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
index 2b6fb20..493166c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -39,35 +39,42 @@ using namespace JSC;
 
 namespace WebCore {
 
-static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValuePtr value)
+static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
 
     JSObject* object = asObject(value);
 
-    JSValuePtr enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
+    JSValue enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
     if (exec->hadException())
         return 0;
-    bool enableHighAccuracy = enableHighAccuracyValue->toBoolean(exec);
+    bool enableHighAccuracy = enableHighAccuracyValue.toBoolean(exec);
     if (exec->hadException())
         return 0;
 
-    JSValuePtr timeoutValue = object->get(exec, Identifier(exec, "timeout"));
+    JSValue timeoutValue = object->get(exec, Identifier(exec, "timeout"));
     if (exec->hadException())
         return 0;
-    unsigned timeout = timeoutValue->toUInt32(exec);
+    unsigned timeout = timeoutValue.toUInt32(exec);
     if (exec->hadException())
         return 0;
 
-    return PositionOptions::create(enableHighAccuracy, timeout);
+    JSValue maximumAgeValue = object->get(exec, Identifier(exec, "maximumAge"));
+    if (exec->hadException())
+        return 0;
+    unsigned maximumAge = maximumAgeValue.toUInt32(exec);
+    if (exec->hadException())
+        return 0;
+
+    return PositionOptions::create(enableHighAccuracy, timeout, maximumAge);
 }
 
-JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
+JSValue JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
     RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(exec, 0)->getObject();
+    JSObject* object = args.at(0).getObject();
     if (exec->hadException())
         return jsUndefined();
     if (!object) {
@@ -79,8 +86,8 @@ JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& arg
         positionCallback = JSCustomPositionCallback::create(object, frame);
     
     RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(exec, 1)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1)->getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -91,22 +98,22 @@ JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& arg
     }
     
     RefPtr<PositionOptions> positionOptions;
-    if (!args.at(exec, 2)->isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(exec, 2));
+    if (!args.at(2).isUndefinedOrNull()) {
+        positionOptions = createPositionOptions(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
     }
 
-    m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     
     return jsUndefined();
 }
 
-JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
+JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
     RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(exec, 0)->getObject();
+    JSObject* object = args.at(0).getObject();
     if (exec->hadException())
         return jsUndefined();
     if (!object) {
@@ -118,8 +125,8 @@ JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
         positionCallback = JSCustomPositionCallback::create(object, frame);
     
     RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(exec, 1)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1)->getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -130,13 +137,13 @@ JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
     }
     
     RefPtr<PositionOptions> positionOptions;
-    if (!args.at(exec, 2)->isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(exec, 2));
+    if (!args.at(2).isUndefinedOrNull()) {
+        positionOptions = createPositionOptions(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
     }
 
-    int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     return jsNumber(exec, watchID);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
index 511c9d7..d559d3b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -40,7 +40,7 @@ namespace WebCore {
         {
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr proto) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
             return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::MasqueradesAsUndefined)); 
         }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index a99a36d..de6565d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -38,7 +38,7 @@ bool JSHTMLAppletElement::customGetOwnPropertySlot(ExecState* exec, const Identi
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLAppletElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLAppletElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@ bool JSHTMLAppletElement::canGetItemsForName(ExecState*, HTMLAppletElement*, con
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index 7ff5392..4100468 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValuePtr getNamedItems(ExecState* exec, HTMLCollection* impl, const Identifier& propertyName)
+static JSValue getNamedItems(ExecState* exec, HTMLCollection* impl, const Identifier& propertyName)
 {
     Vector<RefPtr<Node> > namedItems;
     impl->namedItems(propertyName, namedItems);
@@ -51,7 +51,7 @@ static JSValuePtr getNamedItems(ExecState* exec, HTMLCollection* impl, const Ide
 
 // HTMLCollections are strange objects, they support both get and call,
 // so that document.forms.item(0) and document.forms(0) both work.
-static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callHTMLCollection(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -64,7 +64,7 @@ static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValu
     if (args.size() == 1) {
         // Support for document.all(<index>) etc.
         bool ok;
-        UString string = args.at(exec, 0)->toString(exec);
+        UString string = args.at(0).toString(exec);
         unsigned index = string.toUInt32(&ok, false);
         if (ok)
             return toJS(exec, collection->item(index));
@@ -75,8 +75,8 @@ static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValu
 
     // The second arg, if set, is the index of the item we want
     bool ok;
-    UString string = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toString(exec).toUInt32(&ok, false);
+    UString string = args.at(0).toString(exec);
+    unsigned index = args.at(1).toString(exec).toUInt32(&ok, false);
     if (ok) {
         String pstr = string;
         Node* node = collection->namedItem(pstr);
@@ -99,30 +99,30 @@ CallType JSHTMLCollection::getCallData(CallData& callData)
 
 bool JSHTMLCollection::canGetItemsForName(ExecState* exec, HTMLCollection* thisObj, const Identifier& propertyName)
 {
-    return !getNamedItems(exec, thisObj, propertyName)->isUndefined();
+    return !getNamedItems(exec, thisObj, propertyName).isUndefined();
 }
 
-JSValuePtr JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
     return getNamedItems(exec, thisObj->impl(), propertyName);
 }
 
-JSValuePtr JSHTMLCollection::item(ExecState* exec, const ArgList& args)
+JSValue JSHTMLCollection::item(ExecState* exec, const ArgList& args)
 {
     bool ok;
-    uint32_t index = args.at(exec, 0)->toString(exec).toUInt32(&ok, false);
+    uint32_t index = args.at(0).toString(exec).toUInt32(&ok, false);
     if (ok)
         return toJS(exec, impl()->item(index));
-    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr JSHTMLCollection::namedItem(ExecState* exec, const ArgList& args)
+JSValue JSHTMLCollection::namedItem(ExecState* exec, const ArgList& args)
 {
-    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr toJS(ExecState* exec, HTMLCollection* collection)
+JSValue toJS(ExecState* exec, HTMLCollection* collection)
 {
     if (!collection)
         return jsNull();
@@ -133,10 +133,10 @@ JSValuePtr toJS(ExecState* exec, HTMLCollection* collection)
         return wrapper;
 
     switch (collection->type()) {
-        case HTMLCollection::SelectOptions:
+        case SelectOptions:
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLOptionsCollection, collection);
             break;
-        case HTMLCollection::DocAll:
+        case DocAll:
             typedef HTMLCollection HTMLAllCollection;
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLAllCollection, collection);
             break;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index e6abd29..c113ec7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSHTMLDocument.h"
 
+#include "CharacterNames.h"
 #include "Frame.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCollection.h"
@@ -37,6 +38,8 @@
 #include "JSDOMWindowCustom.h"
 #include "JSDOMWindowShell.h"
 #include "JSHTMLCollection.h"
+#include "SegmentedString.h"
+#include "Tokenizer.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -51,7 +54,7 @@ bool JSHTMLDocument::canGetItemsForName(ExecState*, HTMLDocument* document, cons
     return atomicPropertyName && (document->hasNamedItem(atomicPropertyName) || document->hasExtraNamedItem(atomicPropertyName));
 }
 
-JSValuePtr JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
@@ -78,17 +81,17 @@ JSValuePtr JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propert
 
 // Custom attributes
 
-JSValuePtr JSHTMLDocument::all(ExecState* exec) const
+JSValue JSHTMLDocument::all(ExecState* exec) const
 {
     // If "all" has been overwritten, return the overwritten value
-    JSValuePtr v = getDirect(Identifier(exec, "all"));
+    JSValue v = getDirect(Identifier(exec, "all"));
     if (v)
         return v;
 
     return toJS(exec, static_cast<HTMLDocument*>(impl())->all().get());
 }
 
-void JSHTMLDocument::setAll(ExecState* exec, JSValuePtr value)
+void JSHTMLDocument::setAll(ExecState* exec, JSValue value)
 {
     // Add "all" to the property map.
     putDirect(Identifier(exec, "all"), value);
@@ -96,7 +99,7 @@ void JSHTMLDocument::setAll(ExecState* exec, JSValuePtr value)
 
 // Custom functions
 
-JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
 {
     // For compatibility with other browsers, pass open calls with more than 2 parameters to the window.
     if (args.size() > 2) {
@@ -104,9 +107,9 @@ JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
         if (frame) {
             JSDOMWindowShell* wrapper = toJSDOMWindowShell(frame);
             if (wrapper) {
-                JSValuePtr function = wrapper->get(exec, Identifier(exec, "open"));
+                JSValue function = wrapper->get(exec, Identifier(exec, "open"));
                 CallData callData;
-                CallType callType = function->getCallData(callData);
+                CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
                 return call(exec, function, callType, callData, wrapper, args);
@@ -124,32 +127,42 @@ JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
     return this;
 }
 
-static String writeHelper(ExecState* exec, const ArgList& args)
-{
-    // DOM only specifies single string argument, but NS & IE allow multiple
-    // or no arguments.
+enum NewlineRequirement { DoNotAddNewline, DoAddNewline };
 
-    unsigned size = args.size();
-    if (size == 1)
-        return args.at(exec, 0)->toString(exec);
+static inline void documentWrite(ExecState* exec, const ArgList& args, HTMLDocument* document, NewlineRequirement addNewline)
+{
+    // DOM only specifies single string argument, but browsers allow multiple or no arguments.
+
+    size_t size = args.size();
+
+    UString firstString = args.at(0).toString(exec);
+    SegmentedString segmentedString = String(firstString);
+    if (size != 1) {
+        if (!size)
+            segmentedString.clear();
+        else {
+            for (size_t i = 1; i < size; ++i) {
+                UString subsequentString = args.at(i).toString(exec);
+                segmentedString.append(SegmentedString(String(subsequentString)));
+            }
+        }
+    }
+    if (addNewline)
+        segmentedString.append(SegmentedString(&newlineCharacter, 1));
 
-    Vector<UChar> result;
-    for (unsigned i = 0; i < size; ++i)
-        append(result, args.at(exec, i)->toString(exec));
-    return String::adopt(result);
+    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
+    document->write(segmentedString, activeDocument);
 }
 
-JSValuePtr JSHTMLDocument::write(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::write(ExecState* exec, const ArgList& args)
 {
-    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
-    static_cast<HTMLDocument*>(impl())->write(writeHelper(exec, args), activeDocument);
+    documentWrite(exec, args, static_cast<HTMLDocument*>(impl()), DoNotAddNewline);
     return jsUndefined();
 }
 
-JSValuePtr JSHTMLDocument::writeln(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::writeln(ExecState* exec, const ArgList& args)
 {
-    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
-    static_cast<HTMLDocument*>(impl())->write(writeHelper(exec, args) + "\n", activeDocument);
+    documentWrite(exec, args, static_cast<HTMLDocument*>(impl()), DoAddNewline);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 2856393..19aae86 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -38,7 +38,7 @@ bool JSHTMLEmbedElement::customGetOwnPropertySlot(ExecState* exec, const Identif
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLEmbedElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLEmbedElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@ bool JSHTMLEmbedElement::canGetItemsForName(ExecState*, HTMLEmbedElement*, const
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index 4e16cc5..8bf543c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -26,8 +26,10 @@
 #include "config.h"
 #include "JSHTMLFormElement.h"
 
+#include "Frame.h"
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
+#include "JSDOMWindowCustom.h"
 #include "JSNamedNodesCollection.h"
 
 using namespace JSC;
@@ -41,7 +43,7 @@ bool JSHTMLFormElement::canGetItemsForName(ExecState*, HTMLFormElement* form, co
     return namedItems.size();
 }
 
-JSValuePtr JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     HTMLFormElement* form = static_cast<HTMLFormElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     
@@ -55,4 +57,13 @@ JSValuePtr JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& prop
     return jsUndefined();
 }
 
+JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
+{
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!activeFrame)
+        return jsUndefined();
+    static_cast<HTMLFormElement*>(impl())->submit(0, false, !activeFrame->script()->anyPageIsProcessingUserGesture(), false);
+    return jsUndefined();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index a97a72a..0a5d1f1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -40,14 +40,14 @@ namespace WebCore {
 
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
-    if (protocolIs(parseURL(value), "javascript")) {
+    if (protocolIsJavaScript(parseURL(value))) {
         if (!checkNodeSecurity(exec, imp->contentDocument()))
             return false;
     }
     return true;
 }
 
-void JSHTMLFrameElement::setSrc(ExecState* exec, JSValuePtr value)
+void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
     String srcValue = valueToStringWithNullCheck(exec, value);
@@ -59,7 +59,7 @@ void JSHTMLFrameElement::setSrc(ExecState* exec, JSValuePtr value)
     return;
 }
 
-void JSHTMLFrameElement::setLocation(ExecState* exec, JSValuePtr value)
+void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
     String locationValue = valueToStringWithNullCheck(exec, value);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index f17cb89..05972e6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -27,6 +27,7 @@
 #include "JSHTMLFrameSetElement.h"
 
 #include "Document.h"
+#include "HTMLCollection.h"
 #include "HTMLFrameElement.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
@@ -46,7 +47,7 @@ bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement*
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValuePtr JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
index 1a0fc1c..afff977 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -38,13 +38,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValuePtr value)
+void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
 
     String srcValue = valueToStringWithNullCheck(exec, value);
 
-    if (protocolIs(parseURL(srcValue), "javascript")) {
+    if (protocolIsJavaScript(parseURL(srcValue))) {
         if (!checkNodeSecurity(exec, imp->contentDocument()))
             return;
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index d59ef92..6b47622 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -26,47 +26,93 @@
 #include "config.h"
 #include "JSHTMLInputElement.h"
 
+#include "Document.h"
 #include "HTMLInputElement.h"
+#include "Settings.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-bool JSHTMLInputElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+static bool needsGmailQuirk(HTMLInputElement* input)
 {
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
-    if (input->canHaveSelection())
+    Document* document = input->document();
+
+    const KURL& url = document->url();
+    if (url.host() != "mail.google.com")
+        return false;
+
+    // As with other site-specific quirks, allow website developers to turn this off.
+    // In theory, this allows website developers to check if their fixes are effective.
+    Settings* settings = document->settings();
+    if (!settings)
+        return false;
+    if (!settings->needsSiteSpecificQuirks())
         return false;
 
-    const HashEntry* entry = JSHTMLInputElementPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == jsHTMLInputElementPrototypeFunctionSetSelectionRange) {
-                slot.setUndefined();
-                return true;
-            }
-        }
-    }
-
-    return false;
+    return true;
 }
 
-JSValuePtr JSHTMLInputElement::selectionStart(ExecState* exec) const
+JSValue JSHTMLInputElement::type(ExecState* exec) const
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    const AtomicString& type = input->type();
+
+    DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
+    DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
+
+    if (type == url && needsGmailQuirk(input))
+        return jsString(exec, text);
+    return jsString(exec, type);
+}
+
+JSValue JSHTMLInputElement::selectionStart(ExecState* exec) const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
-        return jsUndefined();
+        return throwError(exec, TypeError);
 
     return jsNumber(exec, input->selectionStart());
 }
 
-JSValuePtr JSHTMLInputElement::selectionEnd(ExecState* exec) const
+void JSHTMLInputElement::setSelectionStart(ExecState* exec, JSValue value)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        throwError(exec, TypeError);
+
+    input->setSelectionStart(value.toInt32(exec));
+}
+
+JSValue JSHTMLInputElement::selectionEnd(ExecState* exec) const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
-        return jsUndefined();
+        return throwError(exec, TypeError);
 
     return jsNumber(exec, input->selectionEnd());
 }
 
+void JSHTMLInputElement::setSelectionEnd(ExecState* exec, JSValue value)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        throwError(exec, TypeError);
+
+    input->setSelectionEnd(value.toInt32(exec));
+}
+
+JSValue JSHTMLInputElement::setSelectionRange(ExecState* exec, const ArgList& args)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        return throwError(exec, TypeError);
+
+    int start = args.at(0).toInt32(exec);
+    int end = args.at(1).toInt32(exec);
+
+    input->setSelectionRange(start, end);
+    return jsUndefined();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index 5ad3454..f7f12b9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -38,7 +38,7 @@ bool JSHTMLObjectElement::customGetOwnPropertySlot(ExecState* exec, const Identi
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLObjectElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLObjectElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@ bool JSHTMLObjectElement::canGetItemsForName(ExecState*, HTMLObjectElement*, con
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
index d60483d..460ba08 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
@@ -35,18 +35,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSHTMLOptionsCollection::length(ExecState* exec) const
+JSValue JSHTMLOptionsCollection::length(ExecState* exec) const
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     return jsNumber(exec, imp->length());
 }
 
-void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValuePtr value)
+void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     ExceptionCode ec = 0;
     unsigned newLength = 0;
-    double lengthValue = value->toNumber(exec);
+    double lengthValue = value.toNumber(exec);
     if (!isnan(lengthValue) && !isinf(lengthValue)) {
         if (lengthValue < 0.0)
             ec = INDEX_SIZE_ERR;
@@ -60,23 +60,23 @@ void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void JSHTMLOptionsCollection::indexSetter(ExecState* exec, unsigned index, JSValuePtr value)
+void JSHTMLOptionsCollection::indexSetter(ExecState* exec, unsigned index, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     HTMLSelectElement* base = static_cast<HTMLSelectElement*>(imp->base());
     selectIndexSetter(base, exec, index, value);
 }
 
-JSValuePtr JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
+JSValue JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
-    HTMLOptionElement* option = toHTMLOptionElement(args.at(exec, 0));
+    HTMLOptionElement* option = toHTMLOptionElement(args.at(0));
     ExceptionCode ec = 0;
     if (args.size() < 2)
         imp->add(option, ec);
     else {
         bool ok;
-        int index = args.at(exec, 1)->toInt32(exec, ok);
+        int index = args.at(1).toInt32(exec, ok);
         if (exec->hadException())
             return jsUndefined();
         if (!ok)
@@ -88,7 +88,7 @@ JSValuePtr JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSHTMLOptionsCollection::remove(ExecState* exec, const ArgList& args)
+JSValue JSHTMLOptionsCollection::remove(ExecState* exec, const ArgList& args)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     JSHTMLSelectElement* base = static_cast<JSHTMLSelectElement*>(asObject(toJS(exec, imp->base())));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
index 4094418..9bb6b75 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
@@ -32,23 +32,23 @@ namespace WebCore {
 using namespace JSC;
 using namespace HTMLNames;
 
-JSValuePtr JSHTMLSelectElement::remove(ExecState* exec, const ArgList& args)
+JSValue JSHTMLSelectElement::remove(ExecState* exec, const ArgList& args)
 {
     HTMLSelectElement& select = *static_cast<HTMLSelectElement*>(impl());
 
     // we support both options index and options objects
-    HTMLElement* element = toHTMLElement(args.at(exec, 0));
+    HTMLElement* element = toHTMLElement(args.at(0));
     if (element && element->hasTagName(optionTag))
         select.remove(static_cast<HTMLOptionElement*>(element)->index());
     else
-        select.remove(args.at(exec, 0)->toInt32(exec));
+        select.remove(args.at(0).toInt32(exec));
 
     return jsUndefined();
 }
 
-void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned index, JSC::JSValuePtr value)
+void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
-    if (value->isUndefinedOrNull())
+    if (value.isUndefinedOrNull())
         select->remove(index);
     else {
         ExceptionCode ec = 0;
@@ -61,7 +61,7 @@ void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned
     }
 }
 
-void JSHTMLSelectElement::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValuePtr value)
+void JSHTMLSelectElement::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     selectIndexSetter(static_cast<HTMLSelectElement*>(impl()), exec, index, value);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h
index 87344b5..a449038 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-void selectIndexSetter(HTMLSelectElement*, JSC::ExecState*, unsigned index, JSC::JSValuePtr);
+void selectIndexSetter(HTMLSelectElement*, JSC::ExecState*, unsigned index, JSC::JSValue);
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
index 1baa6d4..998a364 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -37,17 +37,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionBack);
 }
 
-JSValuePtr nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionForward);
 }
 
-JSValuePtr nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 1, propertyName, jsHistoryPrototypeFunctionGo);
 }
@@ -92,7 +92,7 @@ bool JSHistory::customGetOwnPropertySlot(ExecState* exec, const Identifier& prop
     return true;
 }
 
-bool JSHistory::customPut(ExecState* exec, const Identifier&, JSValuePtr, PutPropertySlot&)
+bool JSHistory::customPut(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
index 2237c7a..4a27bb4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
@@ -22,6 +22,7 @@
 
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
+#include "JSHTMLImageElement.h"
 #include "JSNode.h"
 #include "ScriptExecutionContext.h"
 
@@ -29,15 +30,23 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSImageConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSImageConstructor);
 
 const ClassInfo JSImageConstructor::s_info = { "ImageConstructor", 0, 0, 0 };
 
-JSImageConstructor::JSImageConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSImageConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
+
+    putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
+}
+
+Document* JSImageConstructor::document() const
+{
+    return static_cast<Document*>(m_globalObject->scriptExecutionContext());
 }
 
 static JSObject* constructImage(ExecState* exec, JSObject* constructor, const ArgList& args)
@@ -48,14 +57,16 @@ static JSObject* constructImage(ExecState* exec, JSObject* constructor, const Ar
     int height = 0;
     if (args.size() > 0) {
         widthSet = true;
-        width = args.at(exec, 0)->toInt32(exec);
+        width = args.at(0).toInt32(exec);
     }
     if (args.size() > 1) {
         heightSet = true;
-        height = args.at(exec, 1)->toInt32(exec);
+        height = args.at(1).toInt32(exec);
     }
 
     Document* document = static_cast<JSImageConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Image constructor associated document is unavailable");
 
     // Calling toJS on the document causes the JS document wrapper to be
     // added to the window object. This is done to ensure that JSDocument::mark
@@ -79,8 +90,8 @@ ConstructType JSImageConstructor::getConstructData(ConstructData& constructData)
 void JSImageConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h
index 13cce26..8dc7add 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h
@@ -27,8 +27,8 @@ namespace WebCore {
 
     class JSImageConstructor : public DOMObject {
     public:
-        JSImageConstructor(JSC::ExecState*, ScriptExecutionContext*);
-        Document* document() const { return m_document->impl(); }
+        JSImageConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        Document* document() const;
 
         static const JSC::ClassInfo s_info;
         
@@ -37,7 +37,7 @@ namespace WebCore {
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDocument* m_document;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
index 920121e..32fe58b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, ImageData* imageData)
+JSValue toJS(ExecState* exec, ImageData* imageData)
 {
     if (!imageData)
         return jsNull();
@@ -49,7 +49,7 @@ JSValuePtr toJS(ExecState* exec, ImageData* imageData)
     Identifier dataName(exec, "data");
     DEFINE_STATIC_LOCAL(RefPtr<Structure>, cpaStructure, (JSByteArray::createStructure(jsNull())));
     static const ClassInfo cpaClassInfo = { "CanvasPixelArray", 0, 0, 0 };
-    wrapper->putDirect(dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data(), &cpaClassInfo), DontDelete | ReadOnly);
+    wrapper->putDirect(dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data()->data(), &cpaClassInfo), DontDelete | ReadOnly);
     exec->heap()->reportExtraMemoryCost(imageData->data()->length());
     
     return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index 80c35df..fff7aee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper)
+ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper);
 
 typedef HashMap<JSObject*, JSInspectedObjectWrapper*> WrapperMap;
 typedef HashMap<JSGlobalObject*, WrapperMap*> GlobalObjectWrapperMap;
@@ -47,9 +47,9 @@ static GlobalObjectWrapperMap& wrappers()
 
 const ClassInfo JSInspectedObjectWrapper::s_info = { "JSInspectedObjectWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
 
-JSValuePtr JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValuePtr unwrappedValue)
+JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
 {
-    if (!unwrappedValue->isObject())
+    if (!unwrappedValue.isObject())
         return unwrappedValue;
 
     JSObject* unwrappedObject = asObject(unwrappedValue);
@@ -57,14 +57,14 @@ JSValuePtr JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValuePtr u
     if (unwrappedObject->inherits(&JSInspectedObjectWrapper::s_info))
         return unwrappedObject;
 
-    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->dynamicGlobalObject()))
+    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->lexicalGlobalObject()))
         if (JSInspectedObjectWrapper* wrapper = wrapperMap->get(unwrappedObject))
             return wrapper;
 
-    JSValuePtr prototype = unwrappedObject->prototype();
-    ASSERT(prototype->isNull() || prototype->isObject());
+    JSValue prototype = unwrappedObject->prototype();
+    ASSERT(prototype.isNull() || prototype.isObject());
 
-    if (prototype->isNull())
+    if (prototype.isNull())
         return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(jsNull()));
     return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
 }
@@ -96,11 +96,11 @@ JSInspectedObjectWrapper::~JSInspectedObjectWrapper()
     }
 }
 
-JSValuePtr JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValuePtr value) const
+JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value) const
 {
     // The Inspector is only allowed to pass primitive values and wrapped objects to objects from the inspected page.
 
-    if (!value->isObject())
+    if (!value.isObject())
         return value;
 
     JSQuarantinedObjectWrapper* wrapper = asWrapper(value);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
index 273c0b0..201feb6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class JSInspectedObjectWrapper : public JSQuarantinedObjectWrapper {
     public:
-        static JSC::JSValuePtr wrap(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue);
+        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
         virtual ~JSInspectedObjectWrapper();
 
         static const JSC::ClassInfo s_info;
@@ -48,8 +48,8 @@ namespace WebCore {
         virtual bool allowsCallAsFunction() const { return true; }
         virtual bool allowsGetPropertyNames() const { return true; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 8e13e42..0e14109 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper)
+ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper);
 
 typedef HashMap<JSObject*, JSInspectorCallbackWrapper*> WrapperMap;
 
@@ -53,9 +53,9 @@ static Structure* leakInspectorCallbackWrapperStructure()
     return structure;
 }
 
-JSValuePtr JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValuePtr unwrappedValue)
+JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
 {
-    if (!unwrappedValue->isObject())
+    if (!unwrappedValue.isObject())
         return unwrappedValue;
 
     JSObject* unwrappedObject = asObject(unwrappedValue);
@@ -66,10 +66,10 @@ JSValuePtr JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValuePtr
     if (JSInspectorCallbackWrapper* wrapper = wrappers().get(unwrappedObject))
         return wrapper;
 
-    JSValuePtr prototype = unwrappedObject->prototype();
-    ASSERT(prototype->isNull() || prototype->isObject());
+    JSValue prototype = unwrappedObject->prototype();
+    ASSERT(prototype.isNull() || prototype.isObject());
 
-    if (prototype->isNull()) {
+    if (prototype.isNull()) {
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
@@ -88,7 +88,7 @@ JSInspectorCallbackWrapper::~JSInspectorCallbackWrapper()
     wrappers().remove(unwrappedObject());
 }
 
-JSValuePtr JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValuePtr unwrappedValue) const
+JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValue unwrappedValue) const
 {
     if (JSQuarantinedObjectWrapper* wrapper = asWrapper(unwrappedValue)) {
         // The only time a wrapper should be passed into a JSInspectorCallbackWrapper is when a client-side storage callback
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
index 49157c0..cfc2fb6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class JSInspectorCallbackWrapper : public JSQuarantinedObjectWrapper {
     public:
-        static JSC::JSValuePtr wrap(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue);
+        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
 
         virtual ~JSInspectorCallbackWrapper();
 
@@ -44,8 +44,8 @@ namespace WebCore {
 
         virtual bool allowsCallAsFunction() const { return true; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorControllerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorControllerCustom.cpp
new file mode 100644
index 0000000..b06c9e9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorControllerCustom.cpp
@@ -0,0 +1,298 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectorController.h"
+
+#include "Console.h"
+#if ENABLE(DATABASE)
+#include "Database.h"
+#include "JSDatabase.h"
+#endif
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "InspectorController.h"
+#include "InspectorResource.h"
+#include "JSDOMWindow.h"
+#include "JSInspectedObjectWrapper.h"
+#include "JSInspectorCallbackWrapper.h"
+#include "JSNode.h"
+#include "JSRange.h"
+#include "Node.h"
+#include "Page.h"
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <wtf/Vector.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JavaScriptCallFrame.h"
+#include "JavaScriptDebugServer.h"
+#include "JavaScriptProfile.h"
+#include "JSJavaScriptCallFrame.h"
+#include <profiler/Profile.h>
+#include <profiler/Profiler.h>
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSInspectorController::highlightDOMNode(JSC::ExecState*, const JSC::ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Node* node = toNode(wrapper->unwrappedObject());
+    if (!node)
+        return jsUndefined();
+
+    impl()->highlight(node);
+
+    return jsUndefined();
+}
+
+JSValue JSInspectorController::getResourceDocumentNode(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    bool ok = false;
+    unsigned identifier = args.at(0).toUInt32(exec, ok);
+    if (!ok)
+        return jsUndefined();
+
+    RefPtr<InspectorResource> resource = impl()->resources().get(identifier);
+    ASSERT(resource);
+    if (!resource)
+        return jsUndefined();
+
+    Frame* frame = resource->frame();
+    Document* document = frame->document();
+
+    if (document->isPluginDocument() || document->isImageDocument() || document->isMediaDocument())
+        return jsUndefined();
+
+    ExecState* resourceExec = toJSDOMWindowShell(frame)->window()->globalExec();
+
+    JSLock lock(false);
+    return JSInspectedObjectWrapper::wrap(resourceExec, toJS(resourceExec, document));
+}
+
+JSValue JSInspectorController::search(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Node* node = toNode(args.at(0));
+    if (!node)
+        return jsUndefined();
+
+    String target = args.at(1).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    MarkedArgumentBuffer result;
+    RefPtr<Range> searchRange(rangeOfContents(node));
+
+    ExceptionCode ec = 0;
+    do {
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
+        if (resultRange->collapsed(ec))
+            break;
+
+        // A non-collapsed result range can in some funky whitespace cases still not
+        // advance the range's start position (4509328). Break to avoid infinite loop.
+        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
+        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
+            break;
+
+        result.append(toJS(exec, resultRange.get()));
+
+        setStart(searchRange.get(), newStart);
+    } while (true);
+
+    return constructArray(exec, result);
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInspectorController::databaseTableNames(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Database* database = toDatabase(wrapper->unwrappedObject());
+    if (!database)
+        return jsUndefined();
+
+    MarkedArgumentBuffer result;
+
+    Vector<String> tableNames = database->tableNames();
+    unsigned length = tableNames.size();
+    for (unsigned i = 0; i < length; ++i)
+        result.append(jsString(exec, tableNames[i]));
+
+    return constructArray(exec, result);
+}
+#endif
+
+JSValue JSInspectorController::inspectedWindow(ExecState*, const ArgList&)
+{
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(impl()->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
+}
+
+JSValue JSInspectorController::setting(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    String key = args.at(0).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    const InspectorController::Setting& setting = impl()->setting(key);
+
+    switch (setting.type()) {
+        default:
+        case InspectorController::Setting::NoType:
+            return jsUndefined();
+        case InspectorController::Setting::StringType:
+            return jsString(exec, setting.string());
+        case InspectorController::Setting::DoubleType:
+            return jsNumber(exec, setting.doubleValue());
+        case InspectorController::Setting::IntegerType:
+            return jsNumber(exec, setting.integerValue());
+        case InspectorController::Setting::BooleanType:
+            return jsBoolean(setting.booleanValue());
+        case InspectorController::Setting::StringVectorType: {
+            MarkedArgumentBuffer stringsArray;
+            const Vector<String>& strings = setting.stringVector();
+            const unsigned length = strings.size();
+            for (unsigned i = 0; i < length; ++i)
+                stringsArray.append(jsString(exec, strings[i]));
+            return constructArray(exec, stringsArray);
+        }
+    }
+}
+
+JSValue JSInspectorController::setSetting(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    String key = args.at(0).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    InspectorController::Setting setting;
+
+    JSValue value = args.at(1);
+    if (value.isUndefined() || value.isNull()) {
+        // Do nothing. The setting is already NoType.
+        ASSERT(setting.type() == InspectorController::Setting::NoType);
+    } else if (value.isString())
+        setting.set(value.toString(exec));
+    else if (value.isNumber())
+        setting.set(value.toNumber(exec));
+    else if (value.isBoolean())
+        setting.set(value.toBoolean(exec));
+    else {
+        JSArray* jsArray = asArray(value);
+        if (!jsArray)
+            return jsUndefined();
+        Vector<String> strings;
+        for (unsigned i = 0; i < jsArray->length(); ++i) {
+            String item = jsArray->get(exec, i).toString(exec);
+            if (exec->hadException())
+                return jsUndefined();
+            strings.append(item);
+        }
+        setting.set(strings);
+    }
+
+    if (exec->hadException())
+        return jsUndefined();
+
+    impl()->setSetting(key, setting);
+
+    return jsUndefined();
+}
+
+JSValue JSInspectorController::wrapCallback(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return JSInspectorCallbackWrapper::wrap(exec, args.at(0));
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+JSValue JSInspectorController::currentCallFrame(ExecState* exec, const ArgList&)
+{
+    JavaScriptCallFrame* callFrame = impl()->currentCallFrame();
+    if (!callFrame || !callFrame->isValid())
+        return jsUndefined();
+
+    // FIXME: I am not sure if this is actually needed. Can we just use exec?
+    ExecState* globalExec = callFrame->scopeChain()->globalObject()->globalExec();
+
+    JSLock lock(false);
+    return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
+}
+
+JSValue JSInspectorController::profiles(JSC::ExecState* exec, const JSC::ArgList&)
+{
+    JSLock lock(false);
+    MarkedArgumentBuffer result;
+    const Vector<RefPtr<Profile> >& profiles = impl()->profiles();
+
+    for (size_t i = 0; i < profiles.size(); ++i)
+        result.append(toJS(exec, profiles[i].get()));
+
+    return constructArray(exec, result);
+}
+
+#endif
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index c3f89c3..08ecf2b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSJavaScriptCallFrame.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JavaScriptCallFrame.h"
 #include <runtime/ArrayPrototype.h>
 
@@ -33,10 +35,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
+JSValue JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr exception = noValue();
-    JSValuePtr result = impl()->evaluate(args.at(exec, 0)->toString(exec), exception);
+    JSValue exception;
+    JSValue result = impl()->evaluate(args.at(0).toString(exec), exception);
 
     if (exception)
         exec->setException(exception);
@@ -44,12 +46,12 @@ JSValuePtr JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
     return result;
 }
 
-JSValuePtr JSJavaScriptCallFrame::thisObject(ExecState*) const
+JSValue JSJavaScriptCallFrame::thisObject(ExecState*) const
 {
     return impl()->thisObject() ? impl()->thisObject() : jsNull();
 }
 
-JSValuePtr JSJavaScriptCallFrame::type(ExecState* exec) const
+JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
 {
     switch (impl()->type()) {
         case DebuggerCallFrame::FunctionType:
@@ -62,7 +64,7 @@ JSValuePtr JSJavaScriptCallFrame::type(ExecState* exec) const
     return jsNull();
 }
 
-JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
+JSValue JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
 {
     if (!impl()->scopeChain())
         return jsNull();
@@ -74,7 +76,7 @@ JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
     // we must always have something in the scope chain
     ASSERT(iter != end);
 
-    ArgList list;
+    MarkedArgumentBuffer list;
     do {
         list.append(*iter);
         ++iter;
@@ -84,3 +86,5 @@ JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
new file mode 100644
index 0000000..f7c74ae
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -0,0 +1,129 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSLazyEventListener.h"
+
+#include "Frame.h"
+#include "JSNode.h"
+#include <runtime/FunctionConstructor.h>
+#include <runtime/JSLock.h>
+#include <wtf/RefCountedLeakCounter.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
+#endif
+
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+    : JSEventListener(0, globalObject, true)
+    , m_functionName(functionName)
+    , m_eventParameterName(eventParameterName)
+    , m_code(code)
+    , m_parsed(false)
+    , m_lineNumber(lineNumber)
+    , m_originalNode(node)
+{
+    // We don't retain the original node because we assume it
+    // will stay alive as long as this handler object is around
+    // and we need to avoid a reference cycle. If JS transfers
+    // this handler to another node, parseCode will be called and
+    // then originalNode is no longer needed.
+
+    // A JSLazyEventListener can be created with a line number of zero when it is created with
+    // a setAttribute call from JavaScript, so make the line number 1 in that case.
+    if (m_lineNumber == 0)
+        m_lineNumber = 1;
+
+#ifndef NDEBUG
+    eventListenerCounter.increment();
+#endif
+}
+
+JSLazyEventListener::~JSLazyEventListener()
+{
+#ifndef NDEBUG
+    eventListenerCounter.decrement();
+#endif
+}
+
+JSObject* JSLazyEventListener::jsFunction() const
+{
+    parseCode();
+    return m_jsFunction;
+}
+
+void JSLazyEventListener::parseCode() const
+{
+    if (m_parsed)
+        return;
+
+    if (m_globalObject->scriptExecutionContext()->isDocument()) {
+        JSDOMWindow* window = static_cast<JSDOMWindow*>(m_globalObject);
+        Frame* frame = window->impl()->frame();
+        if (!frame)
+            return;
+        // FIXME: Is this check needed for non-Document contexts?
+        ScriptController* script = frame->script();
+        if (!script->isEnabled() || script->isPaused())
+            return;
+    }
+
+    m_parsed = true;
+
+    ExecState* exec = m_globalObject->globalExec();
+
+    MarkedArgumentBuffer args;
+    UString sourceURL(m_globalObject->scriptExecutionContext()->url().string());
+    args.append(jsNontrivialString(exec, m_eventParameterName));
+    args.append(jsString(exec, m_code));
+
+    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
+    // have been added with setAttribute from a script, and we should pass String() in that case.
+    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
+
+    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
+
+    if (exec->hadException()) {
+        exec->clearException();
+
+        // failed to parse, so let's just make this listener a no-op
+        m_jsFunction = 0;
+    } else if (m_originalNode) {
+        // Add the event's home element to the scope
+        // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
+        ScopeChain scope = listenerAsFunction->scope();
+
+        JSValue thisObj = toJS(exec, m_originalNode);
+        if (thisObj.isObject()) {
+            static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
+            listenerAsFunction->setScope(scope);
+        }
+    }
+
+    // Since we only parse once, there's no need to keep data used for parsing around anymore.
+    m_functionName = String();
+    m_code = String();
+    m_eventParameterName = String();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
new file mode 100644
index 0000000..a5304cf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSLazyEventListener_h
+#define JSLazyEventListener_h
+
+#include "JSEventListener.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+    class Node;
+
+    class JSLazyEventListener : public JSEventListener {
+    public:
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+        {
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, globalObject, node, lineNumber));
+        }
+        virtual ~JSLazyEventListener();
+
+    private:
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+
+        virtual JSC::JSObject* jsFunction() const;
+        virtual bool wasCreatedFromMarkup() const { return true; }
+
+        void parseCode() const;
+
+        mutable String m_functionName;
+        mutable String m_eventParameterName;
+        mutable String m_code;
+        mutable bool m_parsed;
+        int m_lineNumber;
+        Node* m_originalNode;
+    };
+
+} // namespace WebCore
+
+#endif // JSEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index b24a62c..9c5a834 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -37,17 +37,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionReplace);
 }
 
-JSValuePtr nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 0, propertyName, jsLocationPrototypeFunctionReload);
 }
 
-JSValuePtr nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
     return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionAssign);
 }
@@ -76,7 +76,7 @@ bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& pro
             slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
             return true;
         } else if (entry->function() == jsLocationPrototypeFunctionReload) {
-            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            slot.setCustom(this, nonCachingStaticReloadFunctionGetter);
             return true;
         } else if (entry->function() == jsLocationPrototypeFunctionAssign) {
             slot.setCustom(this, nonCachingStaticAssignFunctionGetter);
@@ -93,12 +93,15 @@ bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& pro
     return true;
 }
 
-bool JSLocation::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSLocation::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return true;
 
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return true;
+
     bool sameDomainAccess = allowsAccessFromFrame(exec, frame);
 
     const HashEntry* entry = JSLocation::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -133,177 +136,191 @@ bool JSLocation::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
     return false;
 }
 
-static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory)
+void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
 {
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!url.protocolIs("javascript") || allowsAccessFromFrame(exec, frame)) {
-        bool userGesture = activeFrame->script()->processingUserGesture();
-        frame->loader()->scheduleLocationChange(url.string(), activeFrame->loader()->outgoingReferrer(), lockHistory, userGesture);
-    }
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return;
+    Base::defineGetter(exec, propertyName, getterFunction);
 }
 
-void JSLocation::setHref(ExecState* exec, JSValuePtr value)
+static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return;
+
+    if (!protocolIsJavaScript(url) || allowsAccessFromFrame(exec, frame))
+        frame->loader()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
+}
+
+void JSLocation::setHref(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(exec, frame))
         return;
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, value.toString(exec));
+    if (url.isNull())
         return;
 
-    KURL url = activeFrame->loader()->completeURL(value->toString(exec));
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setProtocol(ExecState* exec, JSValuePtr value)
+void JSLocation::setProtocol(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setProtocol(value->toString(exec));
+    url.setProtocol(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHost(ExecState* exec, JSValuePtr value)
+void JSLocation::setHost(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setHostAndPort(value->toString(exec));
+    url.setHostAndPort(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHostname(ExecState* exec, JSValuePtr value)
+void JSLocation::setHostname(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setHost(value->toString(exec));
+    url.setHost(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setPort(ExecState* exec, JSValuePtr value)
+void JSLocation::setPort(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
     // FIXME: Could make this a little less ugly if String provided a toUnsignedShort function.
-    const UString& portString = value->toString(exec);
+    const UString& portString = value.toString(exec);
     int port = charactersToInt(portString.data(), portString.size());
     if (port < 0 || port > 0xFFFF)
         port = 0;
     url.setPort(port);
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setPathname(ExecState* exec, JSValuePtr value)
+void JSLocation::setPathname(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setPath(value->toString(exec));
+    url.setPath(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setSearch(ExecState* exec, JSValuePtr value)
+void JSLocation::setSearch(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setQuery(value->toString(exec));
+    url.setQuery(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHash(ExecState* exec, JSValuePtr value)
+void JSLocation::setHash(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
     String oldRef = url.ref();
-    String str = value->toString(exec);
+    String str = value.toString(exec);
     if (str.startsWith("#"))
         str = str.substring(1);
     if (oldRef == str || (oldRef.isNull() && str.isEmpty()))
         return;
     url.setRef(str);
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-JSValuePtr JSLocation::replace(ExecState* exec, const ArgList& args)
+JSValue JSLocation::replace(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame) 
+    if (!shouldAllowNavigation(exec, frame))
         return jsUndefined();
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, args.at(0).toString(exec));
+    if (url.isNull())
         return jsUndefined();
 
-    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0)->toString(exec)), true);
+    navigateIfAllowed(exec, frame, url, true, true);
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::reload(ExecState* exec, const ArgList&)
+JSValue JSLocation::reload(ExecState* exec, const ArgList&)
 {
     Frame* frame = impl()->frame();
-    if (!frame)
+    if (!frame || !allowsAccessFromFrame(exec, frame))
         return jsUndefined();
 
-    JSDOMWindow* window = toJSDOMWindow(frame);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    if (!frame->loader()->url().protocolIs("javascript") || (window && window->allowsAccessFrom(exec))) {
-        bool userGesture = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()->script()->processingUserGesture();
-        frame->loader()->scheduleRefresh(userGesture);
-    }
+    if (!protocolIsJavaScript(frame->loader()->url()))
+        frame->loader()->scheduleRefresh(processingUserGesture(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::assign(ExecState* exec, const ArgList& args)
+JSValue JSLocation::assign(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(exec, frame))
         return jsUndefined();
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, args.at(0).toString(exec));
+    if (url.isNull())
         return jsUndefined();
 
     // We want a new history item if this JS was called via a user gesture
-    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0)->toString(exec)), false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::toString(ExecState* exec, const ArgList&)
+JSValue JSLocation::toString(ExecState* exec, const ArgList&)
 {
     Frame* frame = impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    if (!allowsAccessFromFrame(exec, frame))
+    if (!frame || !allowsAccessFromFrame(exec, frame))
         return jsUndefined();
 
     return jsString(exec, impl()->toString());
 }
 
+bool JSLocationPrototype::customPut(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&)
+{
+    return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
+}
+
+void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+{
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return;
+    Base::defineGetter(exec, propertyName, getterFunction);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 6c11bea..495bd53 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -29,7 +29,6 @@
 #include "Document.h"
 #include "JSDocument.h"
 #include "JSMessageChannel.h"
-#include "JSWorkerContext.h"
 #include "MessageChannel.h"
 
 using namespace JSC;
@@ -38,26 +37,22 @@ namespace WebCore {
 
 const ClassInfo JSMessageChannelConstructor::s_info = { "MessageChannelConstructor", 0, 0, 0 };
 
-JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, ScriptExecutionContext* scriptExecutionContext)
+JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSMessageChannelConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
-    , m_scriptExecutionContext(scriptExecutionContext)
+    , m_globalObject(globalObject)
 {
-    if (m_scriptExecutionContext->isDocument())
-        m_contextWrapper = toJS(exec, static_cast<Document*>(scriptExecutionContext));
-#if ENABLE(WORKERS)
-    else if (m_scriptExecutionContext->isWorkerContext())
-        m_contextWrapper = toJSDOMGlobalObject(scriptExecutionContext);
-#endif
-    else
-        ASSERT_NOT_REACHED();
-
-    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 JSMessageChannelConstructor::~JSMessageChannelConstructor()
 {
 }
 
+ScriptExecutionContext* JSMessageChannelConstructor::scriptExecutionContext() const
+{
+    return m_globalObject->scriptExecutionContext();
+}
+
 ConstructType JSMessageChannelConstructor::getConstructData(ConstructData& constructData)
 {
     constructData.native.function = construct;
@@ -66,14 +61,18 @@ ConstructType JSMessageChannelConstructor::getConstructData(ConstructData& const
 
 JSObject* JSMessageChannelConstructor::construct(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    return asObject(toJS(exec, MessageChannel::create(static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext())));
+    ScriptExecutionContext* context = static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "MessageChannel constructor associated document is unavailable");
+
+    return asObject(toJS(exec, MessageChannel::create(context)));
 }
 
 void JSMessageChannelConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_contextWrapper->marked())
-        m_contextWrapper->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h
index 614f6ae..90c29a3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h
@@ -32,12 +32,12 @@ namespace WebCore {
 
     class JSMessageChannelConstructor : public DOMObject {
     public:
-        JSMessageChannelConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSMessageChannelConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         virtual ~JSMessageChannelConstructor();
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
-        ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
+        ScriptExecutionContext* scriptExecutionContext() const;
 
         virtual bool implementsHasInstance() const { return true; }
         static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
@@ -46,8 +46,7 @@ namespace WebCore {
         virtual void mark();
 
     private:
-        ScriptExecutionContext* m_scriptExecutionContext;
-        JSC::JSValuePtr m_contextWrapper;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index d0615de..f4809ae 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,13 +42,10 @@ void JSMessagePort::mark()
 {
     DOMObject::mark();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onmessage()))
-        listener->mark();
+    markIfNotNull(m_impl->onmessage());
+    markIfNotNull(m_impl->onclose());
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onclose()))
-        listener->mark();
-
-    if (MessagePort* entangledPort = m_impl->entangledPort()) {
+    if (MessagePortProxy* entangledPort = m_impl->entangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
         if (wrapper && !wrapper->marked())
             wrapper->mark();
@@ -58,42 +55,40 @@ void JSMessagePort::mark()
     typedef MessagePort::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSMessagePort::startConversation(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::startConversation(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     return toJS(exec, impl()->startConversation(globalObject->scriptExecutionContext(), message).get());
 }
 
-JSValuePtr JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
index 5338d5b..c90dadd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
@@ -33,7 +33,7 @@ bool JSMimeTypeArray::canGetItemsForName(ExecState*, MimeTypeArray* mimeTypeArra
     return mimeTypeArray->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index e7b0764..7bd95b4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -41,7 +41,7 @@ bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Id
     return impl->getNamedItem(propertyName);
 }
 
-JSValuePtr JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
index 8a7ee0e..93a8937 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
@@ -29,13 +29,13 @@
 #include "AtomicString.h"
 #include "Element.h"
 #include "JSNode.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection)
+ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection);
 
 const ClassInfo JSNamedNodesCollection::s_info = { "Collection", 0, 0, 0 };
 
@@ -48,13 +48,13 @@ JSNamedNodesCollection::JSNamedNodesCollection(ExecState* exec, const Vector<Ref
 {
 }
 
-JSValuePtr JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodesCollection* thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
     return jsNumber(exec, thisObj->m_nodes->size());
 }
 
-JSValuePtr JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodesCollection *thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
     return toJS(exec, (*thisObj->m_nodes)[slot.index()].get());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
index 19f194b..3bbc102 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
@@ -44,19 +44,19 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
         }
 
     private:
-        static JSC::JSValuePtr lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         OwnPtr<Vector<RefPtr<Node> > > m_nodes;
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
index 2287426..ea6cceb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
@@ -2,7 +2,7 @@
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
  *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
  *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  *  This library is free software; you can redistribute it and/or
@@ -23,96 +23,12 @@
 #include "config.h"
 #include "JSNavigator.h"
 
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "KURL.h"
 #include "Navigator.h"
-#include "Settings.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-static bool needsYouTubeQuirk(ExecState*, Frame*);
-
-#if 1
-
-static inline bool needsYouTubeQuirk(ExecState*, Frame*)
-{
-    return false;
-}
-
-#else
-
-static bool needsYouTubeQuirk(ExecState* exec, Frame* frame)
-{
-    // This quirk works around a mistaken check in an ad at youtube.com.
-    // There's a function called isSafari that returns false if the function
-    // called isWindows returns true; thus the site malfunctions with Windows Safari.
-
-    // Do the quirk only if the function's name is "isWindows".
-    JSFunction* function = exec->function();
-    if (!function)
-        return false;
-    DEFINE_STATIC_LOCAL(const Identifier, isWindowsFunctionName, (exec, "isWindows"));
-    if (function->functionName() != isWindowsFunctionName)
-        return false;
-
-    // Do the quirk only if the function is called by an "isSafari" function.
-    // However, that function is not itself named -- it is stored in the isSafari
-    // property, though, so that's how we recognize it.
-    ExecState* callingExec = exec->callingExecState();
-    if (!callingExec)
-        return false;
-    JSFunction* callingFunction = callingExec->function();
-    if (!callingFunction)
-        return false;
-    JSObject* thisObject = callingExec->thisValue();
-    if (!thisObject)
-        return false;
-    DEFINE_STATIC_LOCAL(const Identifier, isSafariFunction, (exec, "isSafari"));
-    JSValuePtr isSafariFunction = thisObject->getDirect(isSafariFunctionName);
-    if (isSafariFunction != callingFunction)
-        return false;
-
-    Document* document = frame->document();
-    // FIXME: The document is never null, so we should remove this check along with the
-    // other similar ones in this file when we are absolutely sure it's safe.
-    if (!document)
-        return false;
-
-    // Do the quirk only on the front page of the global version of YouTube.
-    const KURL& url = document->url();
-    if (url.host() != "youtube.com" && url.host() != "www.youtube.com")
-        return false;
-    if (url.path() != "/")
-        return false;
-
-    // As with other site-specific quirks, allow website developers to turn this off.
-    // In theory, this allows website developers to check if their fixes are effective.
-    Settings* settings = frame->settings();
-    if (!settings)
-        return false;
-    if (!settings->needsSiteSpecificQuirks())
-        return false;
-
-    return true;
-}
-
-#endif
-
-JSValuePtr JSNavigator::appVersion(ExecState* exec) const
-{
-    Navigator* imp = static_cast<Navigator*>(impl());
-    Frame* frame = imp->frame();
-    if (!frame)
-        return jsString(exec, "");
-
-    if (needsYouTubeQuirk(exec, frame))
-        return jsString(exec, "");
-    return jsString(exec, imp->appVersion());
-}
-
 void JSNavigator::mark()
 {
     Base::mark();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 2b4d6d4..79ac6b7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -43,6 +43,7 @@
 #include "JSDocumentType.h"
 #include "JSEntity.h"
 #include "JSEntityReference.h"
+#include "JSEventListener.h"
 #include "JSHTMLElement.h"
 #include "JSHTMLElementWrapperFactory.h"
 #include "JSNotation.h"
@@ -51,6 +52,7 @@
 #include "Node.h"
 #include "Notation.h"
 #include "ProcessingInstruction.h"
+#include "RegisteredEventListener.h"
 #include "Text.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -66,62 +68,90 @@ namespace WebCore {
 
 typedef int ExpectionCode;
 
-JSValuePtr JSNode::insertBefore(ExecState* exec, const ArgList& args)
+JSValue JSNode::insertBefore(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->insertBefore(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    bool ok = impl()->insertBefore(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
-JSValuePtr JSNode::replaceChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::replaceChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->replaceChild(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    bool ok = impl()->replaceChild(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 1);
+        return args.at(1);
     return jsNull();
 }
 
-JSValuePtr JSNode::removeChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::removeChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->removeChild(toNode(args.at(exec, 0)), ec);
+    bool ok = impl()->removeChild(toNode(args.at(0)), ec);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
-JSValuePtr JSNode::appendChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->appendChild(toNode(args.at(exec, 0)), ec, true);
+    bool ok = impl()->appendChild(toNode(args.at(0)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
+JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    return jsUndefined();
+}
+
+JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
+        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    return jsUndefined();
+}
+
+void JSNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
+{
+}
+
 void JSNode::mark()
 {
     ASSERT(!marked());
 
     Node* node = m_impl.get();
 
-    // Nodes in the document are kept alive by JSDocument::mark,
-    // so we have no special responsibilities and can just call the base class here.
+    // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
+    // the document, we need to mark the document, but we don't need to explicitly
+    // mark any other nodes.
     if (node->inDocument()) {
-        // But if the document isn't marked we have to mark it to ensure that
-        // nodes reachable from this one are also marked
+        DOMObject::mark();
+        markEventListeners(node->eventListeners());
         if (Document* doc = node->ownerDocument())
             if (DOMObject* docWrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), doc))
                 if (!docWrapper->marked())
                     docWrapper->mark();
-        DOMObject::mark();
         return;
     }
 
@@ -131,14 +161,15 @@ void JSNode::mark()
     for (Node* current = m_impl.get(); current; current = current->parentNode())
         root = current;
 
-    // If we're already marking this tree, then we can simply mark this wrapper
-    // by calling the base class; our caller is iterating the tree.
+    // Nodes in a subtree are marked by the tree's root, so, if the root is already
+    // marking the tree, we don't need to explicitly mark any other nodes.
     if (root->inSubtreeMark()) {
         DOMObject::mark();
+        markEventListeners(node->eventListeners());
         return;
     }
 
-    // Mark the whole tree; use the global set of roots to avoid reentering.
+    // Mark the whole tree subtree.
     root->setInSubtreeMark(true);
     for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
         JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
@@ -161,7 +192,7 @@ void JSNode::mark()
     ASSERT(marked());
 }
 
-static ALWAYS_INLINE JSValuePtr createWrapper(ExecState* exec, Node* node)
+static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, Node* node)
 {
     ASSERT(node);
     ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
@@ -218,7 +249,7 @@ static ALWAYS_INLINE JSValuePtr createWrapper(ExecState* exec, Node* node)
     return wrapper;    
 }
     
-JSValuePtr toJSNewlyCreated(ExecState* exec, Node* node)
+JSValue toJSNewlyCreated(ExecState* exec, Node* node)
 {
     if (!node)
         return jsNull();
@@ -226,7 +257,7 @@ JSValuePtr toJSNewlyCreated(ExecState* exec, Node* node)
     return createWrapper(exec, node);
 }
     
-JSValuePtr toJS(ExecState* exec, Node* node)
+JSValue toJS(ExecState* exec, Node* node)
 {
     if (!node)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 55a282e..f5d4d5c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -29,17 +29,17 @@ namespace WebCore {
 
 using namespace JSC;
 
-ASSERT_CLASS_FITS_IN_CELL(JSNodeFilterCondition)
+ASSERT_CLASS_FITS_IN_CELL(JSNodeFilterCondition);
 
-JSNodeFilterCondition::JSNodeFilterCondition(JSValuePtr filter)
+JSNodeFilterCondition::JSNodeFilterCondition(JSValue filter)
     : m_filter(filter)
 {
 }
 
 void JSNodeFilterCondition::mark()
 {
-    if (!m_filter->marked())
-        m_filter->mark();
+    if (!m_filter.marked())
+        m_filter.mark();
 }
 
 short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
@@ -47,7 +47,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     JSLock lock(false);
 
     CallData callData;
-    CallType callType = m_filter->getCallData(callData);
+    CallType callType = m_filter.getCallData(callData);
     if (callType == CallTypeNone)
         return NodeFilter::FILTER_ACCEPT;
 
@@ -60,16 +60,16 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (!exec)
         return NodeFilter::FILTER_REJECT;
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, filterNode));
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValuePtr result = call(exec, m_filter, callType, callData, m_filter, args);
+    JSValue result = call(exec, m_filter, callType, callData, m_filter, args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    int intResult = result->toInt32(exec);
+    int intResult = result.toInt32(exec);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
index 2600d90..3d591c6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -30,18 +30,18 @@ namespace WebCore {
 
     class JSNodeFilterCondition : public NodeFilterCondition {
     public:
-        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValuePtr filter)
+        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValue filter)
         {
             return adoptRef(new JSNodeFilterCondition(filter));
         }
 
     private:
-        JSNodeFilterCondition(JSC::JSValuePtr filter);
+        JSNodeFilterCondition(JSC::JSValue filter);
 
         virtual short acceptNode(ScriptState*, Node*) const;
         virtual void mark();
 
-        JSC::JSValuePtr m_filter;
+        mutable JSC::JSValue m_filter;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
index bca6e3a..ecc12d5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -41,14 +41,14 @@ void JSNodeFilter::mark()
     DOMObject::mark();
 }
 
-JSValuePtr JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
+JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
 {
-    return jsNumber(exec, impl()->acceptNode(exec, toNode(args.at(exec, 0))));
+    return jsNumber(exec, impl()->acceptNode(exec, toNode(args.at(0))));
 }
 
-PassRefPtr<NodeFilter> toNodeFilter(JSValuePtr value)
+PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
 {
-    if (value->isObject(&JSNodeFilter::s_info))
+    if (value.isObject(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
 
     return NodeFilter::create(JSNodeFilterCondition::create(value));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
index 6498a7c..8fff82e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
@@ -37,7 +37,7 @@ void JSNodeIterator::mark()
     DOMObject::mark();
 }
 
-JSValuePtr JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
+JSValue JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     RefPtr<Node> node = impl()->nextNode(exec, ec);
@@ -52,7 +52,7 @@ JSValuePtr JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
     return toJS(exec, node.get());
 }
 
-JSValuePtr JSNodeIterator::previousNode(ExecState* exec, const ArgList&)
+JSValue JSNodeIterator::previousNode(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     RefPtr<Node> node = impl()->previousNode(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
index a67887e..2821d01 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -36,10 +36,10 @@ using namespace JSC;
 namespace WebCore {
 
 // Need to support call so that list(0) works.
-static JSValuePtr callNodeList(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callNodeList(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     bool ok;
-    unsigned index = args.at(exec, 0)->toString(exec).toUInt32(&ok);
+    unsigned index = args.at(0).toString(exec).toUInt32(&ok);
     if (!ok)
         return jsUndefined();
     return toJS(exec, static_cast<JSNodeList*>(function)->impl()->item(index));
@@ -56,7 +56,7 @@ bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, const Identifier
     return impl->itemWithName(propertyName);
 }
 
-JSValuePtr JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->itemWithName(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
index 42136e5..9e818ff 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "JSOptionConstructor.h"
 
+#include "HTMLNames.h"
 #include "HTMLOptionElement.h"
 #include "JSHTMLOptionElement.h"
 #include "ScriptExecutionContext.h"
@@ -29,39 +30,46 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSOptionConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSOptionConstructor);
 
 const ClassInfo JSOptionConstructor::s_info = { "OptionConstructor", 0, 0, 0 };
 
-JSOptionConstructor::JSOptionConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSOptionConstructor::JSOptionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSOptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
 
+    putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 4), ReadOnly|DontDelete|DontEnum);
 }
 
+Document* JSOptionConstructor::document() const
+{
+    return static_cast<Document*>(m_globalObject->scriptExecutionContext());
+}
+
 static JSObject* constructHTMLOptionElement(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
     Document* document = static_cast<JSOptionConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Option constructor associated document is unavailable");
 
-    ExceptionCode ec = 0;
+    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement(HTMLNames::optionTag, false));
 
-    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement("option", ec));
-    RefPtr<Text> text;
-    if (ec == 0)
-        text = document->createTextNode("");
-    if (ec == 0 && !args.at(exec, 0)->isUndefined())
-        text->setData(args.at(exec, 0)->toString(exec), ec);
+    ExceptionCode ec = 0;
+    RefPtr<Text> text = document->createTextNode("");
+    if (!args.at(0).isUndefined())
+        text->setData(args.at(0).toString(exec), ec);
     if (ec == 0)
         element->appendChild(text.release(), ec);
-    if (ec == 0 && !args.at(exec, 1)->isUndefined())
-        element->setValue(args.at(exec, 1)->toString(exec));
+    if (ec == 0 && !args.at(1).isUndefined())
+        element->setValue(args.at(1).toString(exec));
     if (ec == 0)
-        element->setDefaultSelected(args.at(exec, 2)->toBoolean(exec));
+        element->setDefaultSelected(args.at(2).toBoolean(exec));
     if (ec == 0)
-        element->setSelected(args.at(exec, 3)->toBoolean(exec));
+        element->setSelected(args.at(3).toBoolean(exec));
 
     if (ec) {
         setDOMException(exec, ec);
@@ -80,8 +88,8 @@ ConstructType JSOptionConstructor::getConstructData(ConstructData& constructData
 void JSOptionConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h
index 5234c49..3c87c28 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h
@@ -28,8 +28,8 @@ namespace WebCore {
 
     class JSOptionConstructor : public DOMObject {
     public:
-        JSOptionConstructor(JSC::ExecState*, ScriptExecutionContext*);
-        Document* document() const { return m_document->impl(); }
+        JSOptionConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        Document* document() const;
 
         static const JSC::ClassInfo s_info;
         
@@ -38,7 +38,7 @@ namespace WebCore {
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDocument* m_document;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
index 5e82942..81d4295 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
@@ -33,7 +33,7 @@ bool JSPluginArray::canGetItemsForName(ExecState*, PluginArray* pluginArray, con
     return pluginArray->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
index 2cc3bae..555dd9e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
@@ -32,7 +32,7 @@ bool JSPlugin::canGetItemsForName(ExecState*, Plugin* plugin, const Identifier&
     return plugin->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
index 4d1b8fb..56b0eca 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -20,13 +20,9 @@
 #include "config.h"
 #include "JSPluginElementFunctions.h"
 
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
 #include "JSHTMLElement.h"
-#include "ScriptController.h"
 #include "runtime.h"
 #include "runtime_object.h"
 
@@ -58,10 +54,10 @@ static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
     Instance* instance = pluginInstance(node);
     if (!instance)
         return 0;
-    return JSC::Bindings::Instance::createRuntimeObject(exec, instance);
+    return instance->createRuntimeObject(exec);
 }
 
-JSValuePtr runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
@@ -69,7 +65,7 @@ JSValuePtr runtimeObjectGetter(ExecState* exec, const Identifier&, const Propert
     return runtimeObject ? runtimeObject : jsUndefined();
 }
 
-JSValuePtr runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
@@ -90,7 +86,7 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
     return true;
 }
 
-bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, HTMLElement* element, PutPropertySlot& slot)
+bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
     RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
@@ -101,11 +97,11 @@ bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSV
     return true;
 }
 
-static JSValuePtr callPlugin(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callPlugin(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     Instance* instance = pluginInstance(static_cast<JSHTMLElement*>(function)->impl());
     instance->begin();
-    JSValuePtr result = instance->invokeDefaultMethod(exec, args);
+    JSValue result = instance->invokeDefaultMethod(exec, args);
     instance->end();
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
index a1a86c0..8c9dfa7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -30,10 +30,10 @@ namespace WebCore {
 
     // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
 
-    JSC::JSValuePtr runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-    JSC::JSValuePtr runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
-    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, HTMLElement*, JSC::PutPropertySlot&);
+    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index cec0dab..ad1e556 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -32,13 +32,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper)
+ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper);
 
 const ClassInfo JSQuarantinedObjectWrapper::s_info = { "JSQuarantinedObjectWrapper", 0, 0, 0 };
 
-JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValuePtr value)
+JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
 
     JSObject* object = asObject(value);
@@ -49,16 +49,16 @@ JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValuePtr val
     return static_cast<JSQuarantinedObjectWrapper*>(object);
 }
 
-JSValuePtr JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
 {
-    JSValuePtr v = slot.slotBase();
+    JSValue v = slot.slotBase();
     ASSERT(v);
     return v;
 }
 
 JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
     : JSObject(structure)
-    , m_unwrappedGlobalObject(unwrappedExec->dynamicGlobalObject())
+    , m_unwrappedGlobalObject(unwrappedExec->lexicalGlobalObject())
     , m_unwrappedObject(unwrappedObject)
 {
     ASSERT_ARG(unwrappedExec, unwrappedExec);
@@ -72,7 +72,7 @@ JSQuarantinedObjectWrapper::~JSQuarantinedObjectWrapper()
 
 bool JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom(ExecState* exec) const
 {
-    return m_unwrappedGlobalObject->profileGroup() == exec->dynamicGlobalObject()->profileGroup();
+    return m_unwrappedGlobalObject->profileGroup() == exec->lexicalGlobalObject()->profileGroup();
 }
 
 ExecState* JSQuarantinedObjectWrapper::unwrappedExecState() const
@@ -87,8 +87,9 @@ void JSQuarantinedObjectWrapper::transferExceptionToExecState(ExecState* exec) c
     if (!unwrappedExecState()->hadException())
         return;
 
-    exec->setException(wrapOutgoingValue(unwrappedExecState(), unwrappedExecState()->exception()));
+    JSValue exception = unwrappedExecState()->exception();
     unwrappedExecState()->clearException();
+    exec->setException(wrapOutgoingValue(unwrappedExecState(), exception));
 }
 
 void JSQuarantinedObjectWrapper::mark()
@@ -111,7 +112,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, const Ident
     PropertySlot unwrappedSlot(m_unwrappedObject);
     bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
     if (result) {
-        JSValuePtr unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
         slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
     }
 
@@ -130,7 +131,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     PropertySlot unwrappedSlot(m_unwrappedObject);
     bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
     if (result) {
-        JSValuePtr unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
         slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
     }
 
@@ -139,7 +140,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     return result;
 }
 
-void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValuePtr value, PutPropertySlot& slot)
+void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     if (!allowsSetProperty())
         return;
@@ -149,7 +150,7 @@ void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifi
     transferExceptionToExecState(exec);
 }
 
-void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValuePtr value)
+void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValue value)
 {
     if (!allowsSetProperty())
         return;
@@ -187,9 +188,9 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
 {
     JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(constructor);
 
-    ArgList preparedArgs;
+    MarkedArgumentBuffer preparedArgs;
     for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
 
     // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getConstructData
     // from when we called it in JSQuarantinedObjectWrapper::getConstructData.
@@ -197,10 +198,10 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
     ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
     ASSERT(unwrappedConstructType != ConstructTypeNone);
 
-    JSValuePtr unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
+    JSValue unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
 
-    JSValuePtr resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
-    ASSERT(resultValue->isObject());
+    JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+    ASSERT(resultValue.isObject());
     JSObject* result = asObject(resultValue);
 
     wrapper->transferExceptionToExecState(exec);
@@ -219,7 +220,7 @@ ConstructType JSQuarantinedObjectWrapper::getConstructData(ConstructData& constr
     return ConstructTypeHost;
 }
 
-bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto)
+bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 {
     if (!allowsHasInstance())
         return false;
@@ -231,15 +232,15 @@ bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValuePtr value,
     return result;
 }
 
-JSValuePtr JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(function);
 
-    JSValuePtr preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
+    JSValue preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
 
-    ArgList preparedArgs;
+    MarkedArgumentBuffer preparedArgs;
     for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
 
     // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getCallData
     // from when we called it in JSQuarantinedObjectWrapper::getCallData.
@@ -247,9 +248,9 @@ JSValuePtr JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function,
     CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
     ASSERT(unwrappedCallType != CallTypeNone);
 
-    JSValuePtr unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
+    JSValue unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
 
-    JSValuePtr result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+    JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
 
     wrapper->transferExceptionToExecState(exec);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index d66dc46..bf8fddb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class JSQuarantinedObjectWrapper : public JSC::JSObject {
     public:
-        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValuePtr);
+        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValue);
 
         virtual ~JSQuarantinedObjectWrapper();
 
@@ -45,7 +45,7 @@ namespace WebCore {
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr proto) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
             return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::OverridesHasInstance)); 
         }
@@ -59,8 +59,8 @@ namespace WebCore {
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
 
-        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned, JSC::JSValuePtr);
+        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
 
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
@@ -68,7 +68,7 @@ namespace WebCore {
         virtual JSC::CallType getCallData(JSC::CallData&);
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
 
-        virtual bool hasInstance(JSC::ExecState*, JSC::JSValuePtr, JSC::JSValuePtr proto);
+        virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
 
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
@@ -82,14 +82,14 @@ namespace WebCore {
         virtual bool allowsCallAsFunction() const { return false; }
         virtual bool allowsGetPropertyNames() const { return false; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const = 0;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const = 0;
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
 
-        static JSC::JSValuePtr cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         void transferExceptionToExecState(JSC::ExecState*) const;
 
-        static JSC::JSValuePtr call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValuePtr thisValue, const JSC::ArgList&);
+        static JSC::JSValue JSC_HOST_CALL call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValue thisValue, const JSC::ArgList&);
         static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
 
         JSC::JSGlobalObject* m_unwrappedGlobalObject;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
index 91fe4b3..f7c87e2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
@@ -28,9 +28,9 @@
 
 using namespace JSC;
 
-static JSValuePtr jsRGBColorRed(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsRGBColorGreen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsRGBColorBlue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorRed(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorGreen(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorBlue(ExecState*, const Identifier&, const PropertySlot&);
 
 /*
 @begin JSRGBColorTable
@@ -44,7 +44,7 @@ static JSValuePtr jsRGBColorBlue(ExecState*, const Identifier&, const PropertySl
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSRGBColor)
+ASSERT_CLASS_FITS_IN_CELL(JSRGBColor);
 
 const ClassInfo JSRGBColor::s_info = { "RGBColor", 0, &JSRGBColorTable, 0 };
 
@@ -59,7 +59,7 @@ bool JSRGBColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSRGBColor, DOMObject>(exec, &JSRGBColorTable, this, propertyName, slot);
 }
 
-JSValuePtr getJSRGBColor(ExecState* exec, unsigned color)
+JSValue getJSRGBColor(ExecState* exec, unsigned color)
 {
     return new (exec) JSRGBColor(exec, color);
 }
@@ -68,17 +68,17 @@ JSValuePtr getJSRGBColor(ExecState* exec, unsigned color)
 
 using namespace WebCore;
 
-JSValuePtr jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 16) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
 
-JSValuePtr jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 8) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
 
-JSValuePtr jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create(static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
index d5acff3..cc2870f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
@@ -38,12 +38,12 @@ namespace WebCore {
 
         unsigned impl() const { return m_color; }
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
         }
@@ -52,7 +52,7 @@ namespace WebCore {
         unsigned m_color;
     };
 
-    JSC::JSValuePtr getJSRGBColor(JSC::ExecState*, unsigned color);
+    JSC::JSValue getJSRGBColor(JSC::ExecState*, unsigned color);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
index 8c01d0c..f40956e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JSSQLResultSetRowList.h"
 
+#if ENABLE(DATABASE)
+
 #include "ExceptionCode.h"
 #include "SQLValue.h"
 #include "SQLResultSetRowList.h"
@@ -37,10 +39,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
+JSValue JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    int index = args.at(exec, 0)->toInt32(exec, indexOk);
+    int index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -56,7 +58,7 @@ JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
     unsigned valuesIndex = index * numColumns;
     for (unsigned i = 0; i < numColumns; i++) {
         const SQLValue& value = m_impl->values()[valuesIndex + i];
-        JSValuePtr jsValue = noValue();
+        JSValue jsValue;
 
         switch (value.type()) {
             case SQLValue::StringValue:
@@ -79,3 +81,5 @@ JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
index 3cab8c4..30d59aa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JSSQLTransaction.h"
 
+#if ENABLE(DATABASE)
+
 #include "DOMWindow.h"
 #include "ExceptionCode.h"
 #include "JSCustomSQLStatementCallback.h"
@@ -40,40 +42,40 @@ using namespace JSC;
 
 namespace WebCore {
     
-JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
+JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
 {
-    String sqlStatement = args.at(exec, 0)->toString(exec);
+    String sqlStatement = args.at(0).toString(exec);
     if (exec->hadException())
         return jsUndefined();
 
     // Now assemble the list of SQL arguments
     Vector<SQLValue> sqlValues;
-    if (!args.at(exec, 1)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1)->getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
 
-        JSValuePtr lengthValue = object->get(exec, exec->propertyNames().length);
+        JSValue lengthValue = object->get(exec, exec->propertyNames().length);
         if (exec->hadException())
             return jsUndefined();
-        unsigned length = lengthValue->toUInt32(exec);
+        unsigned length = lengthValue.toUInt32(exec);
         if (exec->hadException())
             return jsUndefined();
         
         for (unsigned i = 0 ; i < length; ++i) {
-            JSValuePtr value = object->get(exec, i);
+            JSValue value = object->get(exec, i);
             if (exec->hadException())
                 return jsUndefined();
             
-            if (value->isNull())
+            if (value.isNull())
                 sqlValues.append(SQLValue());
-            else if (value->isNumber())
-                sqlValues.append(value->getNumber());
+            else if (value.isNumber())
+                sqlValues.append(value.uncheckedGetNumber());
             else {
                 // Convert the argument to a string and append it
-                sqlValues.append(value->toString(exec));
+                sqlValues.append(value.toString(exec));
                 if (exec->hadException())
                     return jsUndefined();
             }
@@ -81,8 +83,8 @@ JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
     }
 
     RefPtr<SQLStatementCallback> callback;
-    if (!args.at(exec, 2)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 2)->getObject();
+    if (!args.at(2).isUndefinedOrNull()) {
+        JSObject* object = args.at(2).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -93,8 +95,8 @@ JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
     }
     
     RefPtr<SQLStatementErrorCallback> errorCallback;
-    if (!args.at(exec, 3)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 3)->getObject();
+    if (!args.at(3).isUndefinedOrNull()) {
+        JSObject* object = args.at(3).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -112,3 +114,5 @@ JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index ea2471e..2922740 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -26,36 +26,47 @@
 #include "config.h"
 
 #if ENABLE(SVG)
-#include "SVGElementInstance.h"
 #include "JSSVGElementInstance.h"
 
-#include "JSEventListener.h"
 #include "JSDOMWindow.h"
+#include "JSEventListener.h"
+#include "JSSVGElement.h"
+#include "SVGElementInstance.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
+void JSSVGElementInstance::mark()
+{
+    DOMObject::mark();
+
+    // Mark the wrapper for our corresponding element, so it can mark its event handlers.
+    JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
+    if (correspondingWrapper && !correspondingWrapper->marked())
+        correspondingWrapper->mark();
+}
+
+JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1)))
-        impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-JSValuePtr JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(exec, 1)))
-        impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
+        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
@@ -64,6 +75,17 @@ void JSSVGElementInstance::pushEventHandlerScope(ExecState*, ScopeChain&) const
 {
 }
 
+JSC::JSValue toJS(JSC::ExecState* exec, SVGElementInstance* object)
+{
+    JSValue result = getDOMObjectWrapper<JSSVGElementInstance>(exec, object);
+
+    // Ensure that our corresponding element has a JavaScript wrapper to keep its event handlers alive.
+    if (object)
+        toJS(exec, object->correspondingElement());
+
+    return result;
 }
 
-#endif
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
index 6dd8507..bad52ae 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
@@ -26,18 +26,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGLength::value(ExecState* exec) const
+JSValue JSSVGLength::value(ExecState* exec) const
 {
     SVGLength imp(*impl());
     return jsNumber(exec, imp.value(context()));
 }
 
-JSValuePtr JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
+JSValue JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
 {
     JSSVGPODTypeWrapper<SVGLength>* wrapper = impl();
 
     SVGLength imp(*wrapper);
-    imp.convertToSpecifiedUnits(args.at(exec, 0)->toInt32(exec), context());
+    imp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context());
 
     wrapper->commitChange(imp, context());
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
index fdf9d5e..fc1e266 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -29,18 +29,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGMatrix::multiply(ExecState* exec, const ArgList& args)
+JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 {
     TransformationMatrix imp(*impl());
-
-    TransformationMatrix secondMatrix = toSVGMatrix(args.at(exec, 0));    
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.multiply(secondMatrix)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
-{
-    TransformationMatrix imp(*impl());
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
 
     if (!imp.isInvertible())
         setDOMException(exec, SVGException::SVG_MATRIX_NOT_INVERTABLE);
@@ -48,50 +40,14 @@ JSValuePtr JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
     return result;
 }
 
-JSValuePtr JSSVGMatrix::translate(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.translate(x, y)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::scale(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float scaleFactor = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scale(scaleFactor)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::scaleNonUniform(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float scaleFactorX = args.at(exec, 0)->toFloat(exec);
-    float scaleFactorY = args.at(exec, 1)->toFloat(exec);
-
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scaleNonUniform(scaleFactorX, scaleFactorY)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::rotate(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float angle = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotate(angle)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
+JSValue JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
 {
     TransformationMatrix imp(*impl());
  
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
 
     if (x == 0.0 || y == 0.0)
         setDOMException(exec, SVGException::SVG_INVALID_VALUE_ERR);
@@ -99,34 +55,6 @@ JSValuePtr JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
     return result;
 }
 
-JSValuePtr JSSVGMatrix::flipX(ExecState* exec, const ArgList&)
-{
-    TransformationMatrix imp(*impl());
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipX()).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::flipY(ExecState* exec, const ArgList&)
-{
-    TransformationMatrix imp(*impl());
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipY()).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::skewX(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float angle = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewX(angle)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::skewY(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float angle = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewY(angle)).get(), m_context.get());
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
index c30f97f..51e4e9e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
@@ -28,7 +28,6 @@
 #define JSSVGPODTypeWrapper_h
 
 #if ENABLE(SVG)
-#include "Frame.h"
 #include "SVGElement.h"
 #include <wtf/StdLibExtras.h>
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index b7490e7..cb4687c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -59,7 +59,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, SVGPathSeg* object, SVGElement* context)
+JSValue toJS(ExecState* exec, SVGPathSeg* object, SVGElement* context)
 {
     if (!object)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
index 6197b48..b6fc116 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
 
@@ -48,28 +48,28 @@ JSValuePtr JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
     return jsUndefined();
 }
 
-JSValuePtr JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
     SVGPathSeg* obj = WTF::getPtr(imp->initialize(newItem, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj, m_context.get());
+    JSC::JSValue result = toJS(exec, obj, m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
 
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -78,18 +78,18 @@ JSValuePtr JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
     SVGPathSeg* obj = WTF::getPtr(imp->getItem(index, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj, m_context.get());
+    JSC::JSValue result = toJS(exec, obj, m_context.get());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -97,20 +97,20 @@ JSValuePtr JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& ar
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
     
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -118,19 +118,19 @@ JSValuePtr JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,21 +140,21 @@ JSValuePtr JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
 
     RefPtr<SVGPathSeg> obj(imp->removeItem(index, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj.get(), m_context.get());
+    JSC::JSValue result = toJS(exec, obj.get(), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
index a2e74ae..a18c2a2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
@@ -33,7 +33,7 @@ namespace WebCore {
 typedef SVGPODListItem<FloatPoint> PODListItem;
 typedef SVGList<RefPtr<PODListItem> > SVGPointListBase;
 
-static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -42,7 +42,7 @@ static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), list->associatedAttributeName()).get(), context);
 }
 
-static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -53,7 +53,7 @@ static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), attributeName).get(), context);
 }
 
-static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -63,7 +63,7 @@ static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec,
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(*item).get(), context);
 }
 
-JSValuePtr JSSVGPointList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGPointList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     impl()->clear(ec);
@@ -72,18 +72,18 @@ JSValuePtr JSSVGPointList::clear(ExecState* exec, const ArgList&)
     return jsUndefined();
 }
 
-JSValuePtr JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(0))), ec));
 }
 
-JSValuePtr JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -95,10 +95,10 @@ JSValuePtr JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
         listImp->getItem(index, ec));
 }
 
-JSValuePtr JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -107,13 +107,13 @@ JSValuePtr JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -122,13 +122,13 @@ JSValuePtr JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,12 +140,12 @@ JSValuePtr JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
         listImp->removeItem(index, ec));
 }
 
-JSValuePtr JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(0))), ec));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
index b29b259..58b25ad 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
@@ -33,7 +33,7 @@ namespace WebCore {
 typedef SVGPODListItem<SVGTransform> PODListItem;
 typedef SVGList<RefPtr<PODListItem> > SVGTransformListBase;
 
-static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -42,7 +42,7 @@ static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), list->associatedAttributeName()).get(), context);
 }
 
-static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -53,7 +53,7 @@ static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), attributeName).get(), context);
 }
 
-static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -63,7 +63,7 @@ static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec,
     return toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(*item).get(), context);
 }
 
-JSValuePtr JSSVGTransformList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGTransformList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     impl()->clear(ec);
@@ -72,18 +72,18 @@ JSValuePtr JSSVGTransformList::clear(ExecState* exec, const ArgList&)
     return jsUndefined();
 }
 
-JSValuePtr JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(0))), ec));
 }
 
-JSValuePtr JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -95,10 +95,10 @@ JSValuePtr JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
         listImp->getItem(index, ec));
 }
 
-JSValuePtr JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -107,13 +107,13 @@ JSValuePtr JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList&
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -122,13 +122,13 @@ JSValuePtr JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,12 +140,12 @@ JSValuePtr JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
         listImp->removeItem(index, ec));
 }
 
-JSValuePtr JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(0))), ec));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
index a92da25..bc43d79 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
@@ -41,7 +41,7 @@ bool JSStorage::canGetItemsForName(ExecState*, Storage* impl, const Identifier&
     return impl->contains(propertyName);
 }
 
-JSValuePtr JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSStorage* thisObj = static_cast<JSStorage*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
@@ -56,8 +56,8 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
         return false;
         
-    JSValuePtr prototype = this->prototype();
-    if (prototype->isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+    JSValue prototype = this->prototype();
+    if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return false;
 
     m_impl->removeItem(propertyName);
@@ -74,7 +74,7 @@ bool JSStorage::customGetPropertyNames(ExecState* exec, PropertyNameArray& prope
     return false;
 }
 
-bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     // Only perform the custom put if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
@@ -83,11 +83,11 @@ bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSVal
     if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
         return false;
         
-    JSValuePtr prototype = this->prototype();
-    if (prototype->isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+    JSValue prototype = this->prototype();
+    if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return false;
     
-    String stringValue = valueToStringWithNullCheck(exec, value);
+    String stringValue = value.toString(exec);
     if (exec->hadException())
         return true;
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 04dabf0..f8146bd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -27,6 +27,7 @@
 #include "JSStyleSheet.h"
 
 #include "CSSStyleSheet.h"
+#include "Node.h"
 #include "JSCSSStyleSheet.h"
 #include "JSNode.h"
 
@@ -34,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, StyleSheet* styleSheet)
+JSValue toJS(ExecState* exec, StyleSheet* styleSheet)
 {
     if (!styleSheet)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index ea41687..1da6418 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -40,7 +40,7 @@ bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheet
     return styleSheetList->getNamedItem(propertyName);
 }
 
-JSValuePtr JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
     HTMLStyleElement* element = thisObj->impl()->getNamedItem(propertyName);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp
index 8118aef..9e66826 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJSNewlyCreated(ExecState* exec, Text* text)
+JSValue toJSNewlyCreated(ExecState* exec, Text* text)
 {
     if (!text)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
index aca0f93..6369017 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
@@ -37,7 +37,7 @@ void JSTreeWalker::mark()
     DOMObject::mark();
 }
     
-JSValuePtr JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->parentNode(exec);
     if (exec->hadException())
@@ -45,7 +45,7 @@ JSValuePtr JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->firstChild(exec);
     if (exec->hadException())
@@ -53,7 +53,7 @@ JSValuePtr JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->lastChild(exec);
     if (exec->hadException())
@@ -61,7 +61,7 @@ JSValuePtr JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->nextSibling(exec);
     if (exec->hadException())
@@ -69,7 +69,7 @@ JSValuePtr JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->previousSibling(exec);
     if (exec->hadException())
@@ -77,7 +77,7 @@ JSValuePtr JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->previousNode(exec);
     if (exec->hadException())
@@ -85,7 +85,7 @@ JSValuePtr JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::nextNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::nextNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->nextNode(exec);
     if (exec->hadException())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp
new file mode 100644
index 0000000..c7fe4a5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSWebKitCSSMatrixConstructor.h"
+
+#include "WebKitCSSMatrix.h"
+#include "JSWebKitCSSMatrix.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+const ClassInfo JSWebKitCSSMatrixConstructor::s_info = { "WebKitCSSMatrixConstructor", 0, 0, 0 };
+
+JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor(ExecState* exec)
+    : DOMObject(JSWebKitCSSMatrixConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    putDirect(exec->propertyNames().prototype, JSWebKitCSSMatrixPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructWebKitCSSMatrix(ExecState* exec, JSObject*, const ArgList& args)
+{
+    String s;
+    if (args.size() >= 1)
+        s = args.at(0).toString(exec);
+    
+    ExceptionCode ec = 0;
+    RefPtr<WebKitCSSMatrix> matrix = WebKitCSSMatrix::create(s, ec);
+    setDOMException(exec, ec);
+    return CREATE_DOM_OBJECT_WRAPPER(exec, WebKitCSSMatrix, matrix.get());
+}
+
+ConstructType JSWebKitCSSMatrixConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructWebKitCSSMatrix;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h
new file mode 100644
index 0000000..d0e0bd1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebKitCSSMatrixConstructor_h
+#define JSWebKitCSSMatrixConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+class JSWebKitCSSMatrixConstructor : public DOMObject {
+public:
+    JSWebKitCSSMatrixConstructor(JSC::ExecState*);
+    static const JSC::ClassInfo s_info;
+
+private:
+    virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+};
+
+}
+
+#endif // JSWebKitCSSMatrixConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.cpp
index 12fd98b..c7d4e36 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,52 +20,49 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 #include "config.h"
-#include "JSEventTargetNode.h"
+#include "JSWebKitPointConstructor.h"
 
-#include "AtomicString.h"
 #include "Document.h"
-#include "Event.h"
-#include "EventTargetNode.h"
-#include "ExceptionCode.h"
-#include "Frame.h"
-#include "JSDOMWindow.h"
-#include "JSEvent.h"
-#include "JSEventListener.h"
-
-using namespace JSC;
+#include "WebKitPoint.h"
+#include "JSWebKitPoint.h"
 
 namespace WebCore {
 
-JSValuePtr JSEventTargetNode::addEventListener(ExecState* exec, const ArgList& args)
-{
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
+using namespace JSC;
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1)))
-        impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+const ClassInfo JSWebKitPointConstructor::s_info = { "WebKitPointConstructor", 0, 0, 0 };
 
-    return jsUndefined();
+JSWebKitPointConstructor::JSWebKitPointConstructor(ExecState* exec)
+    : DOMObject(JSWebKitPointConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    putDirect(exec->propertyNames().prototype, JSWebKitPointPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-JSValuePtr JSEventTargetNode::removeEventListener(ExecState* exec, const ArgList& args)
+static JSObject* constructWebKitPoint(ExecState* exec, JSObject*, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(exec, 1)))
-        impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
-
-    return jsUndefined();
+    float x = 0;
+    float y = 0;
+    if (args.size() >= 2) {
+        x = (float)args.at(0).toNumber(exec);
+        y = (float)args.at(1).toNumber(exec);
+        if (isnan(x))
+            x = 0;
+        if (isnan(y))
+            y = 0;
+    }
+    return asObject(toJS(exec, WebKitPoint::create(x, y)));
 }
 
-void JSEventTargetNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
+JSC::ConstructType JSWebKitPointConstructor::getConstructData(JSC::ConstructData& constructData)
 {
+    constructData.native.function = constructWebKitPoint;
+    return ConstructTypeHost;
 }
 
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.h
index 200b9b1..a5bb5c1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,49 +20,27 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef DOMTimer_h
-#define DOMTimer_h
+#ifndef JSWebKitPointConstructor_h
+#define JSWebKitPointConstructor_h
 
-#include "ActiveDOMObject.h"
-#include "Timer.h"
-#include <wtf/OwnPtr.h>
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
 
 namespace WebCore {
 
-class ScheduledAction;
-
-class DOMTimer : public TimerBase, public ActiveDOMObject {
+class JSWebKitPointConstructor : public DOMObject {
 public:
-    virtual ~DOMTimer();
-    // Creates a new timer owned by specified ScriptExecutionContext, starts it
-    // and returns its Id.
-    static int install(ScriptExecutionContext*, ScheduledAction*, int timeout, bool singleShot);
-    static void removeById(ScriptExecutionContext*, int timeoutId);
-
-    // ActiveDOMObject
-    virtual bool hasPendingActivity() const;
-    virtual void contextDestroyed();
-    virtual void stop();
-    virtual bool canSuspend() const;
-    virtual void suspend();
-    virtual void resume();
+    JSWebKitPointConstructor(JSC::ExecState*);
+    static const JSC::ClassInfo s_info;
 
 private:
-    DOMTimer(ScriptExecutionContext*, ScheduledAction*, int timeout, bool singleShot);
-    virtual void fired();
-
-    int m_timeoutId;
-    int m_nestingLevel;
-    OwnPtr<ScheduledAction> m_action;
-    double m_nextFireInterval;
-    double m_repeatInterval;
+    virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 };
 
-} // namespace WebCore
-
-#endif // DOMTimer_h
+}
 
+#endif // JSWebKitPointConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
index 2c964c3..8ea6718 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
@@ -44,6 +44,7 @@ const ClassInfo JSWorkerConstructor::s_info = { "WorkerConstructor", 0, 0, 0 };
 JSWorkerConstructor::JSWorkerConstructor(ExecState* exec)
     : DOMObject(JSWorkerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
+    putDirect(exec->propertyNames().prototype, JSWorkerPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
 }
 
@@ -52,7 +53,7 @@ static JSObject* constructWorker(ExecState* exec, JSObject*, const ArgList& args
     if (args.size() == 0)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    UString scriptURL = args.at(exec, 0)->toString(exec);
+    UString scriptURL = args.at(0).toString(exec);
     if (exec->hadException())
         return 0;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
index 24dd50f..c71f45b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,29 +31,16 @@
 
 #include "JSWorkerContextBase.h"
 
-#include "Event.h"
-#include "JSDOMBinding.h"
-#include "JSEventListener.h"
-#include "JSMessageChannelConstructor.h"
-#include "JSMessageEvent.h"
-#include "JSMessagePort.h"
-#include "JSWorkerLocation.h"
-#include "JSWorkerNavigator.h"
+#include "JSWorkerContext.h"
 #include "WorkerContext.h"
-#include "WorkerLocation.h"
 
 using namespace JSC;
 
-/*
-@begin JSWorkerContextBaseTable
-@end
-*/
-
-#include "JSWorkerContextBase.lut.h"
-
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase)
+ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
+
+const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(PassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
     : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
@@ -69,16 +57,14 @@ ScriptExecutionContext* JSWorkerContextBase::scriptExecutionContext() const
     return m_impl.get();
 }
 
-static const HashTable* getJSWorkerContextBaseTable(ExecState* exec)
-{
-    return getHashTableForGlobalData(exec->globalData(), &JSWorkerContextBaseTable);
-}
-
-const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, getJSWorkerContextBaseTable };
-
-void JSWorkerContextBase::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+JSValue toJS(ExecState*, WorkerContext* workerContext)
 {
-    lookupPut<JSWorkerContextBase, Base>(exec, propertyName, value, getJSWorkerContextBaseTable(exec), this, slot);
+    if (!workerContext)
+        return jsNull();
+    WorkerScriptController* script = workerContext->script();
+    if (!script)
+        return jsNull();
+    return script->workerContextWrapper();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
index d2d5bd2..dcbc5c3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,7 +41,6 @@ namespace WebCore {
         JSWorkerContextBase(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
         virtual ~JSWorkerContextBase();
 
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
@@ -52,6 +51,9 @@ namespace WebCore {
         RefPtr<WorkerContext> m_impl;
     };
 
+    // Returns a JSWorkerContext or jsNull()
+    JSC::JSValue toJS(JSC::ExecState*, WorkerContext*);
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 2bf4dbc..6824914 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,68 +31,113 @@
 
 #include "JSDOMBinding.h"
 #include "JSEventListener.h"
+#include "JSWorkerLocation.h"
+#include "JSWorkerNavigator.h"
+#include "JSXMLHttpRequestConstructor.h"
+#include "ScheduledAction.h"
 #include "WorkerContext.h"
+#include "WorkerLocation.h"
+#include "WorkerNavigator.h"
+#include <interpreter/Interpreter.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-bool JSWorkerContext::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
-{
-    // Look for overrides before looking at any of our own properties.
-    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
-        return true;
-    return false;
-}
-
 void JSWorkerContext::mark()
 {
     Base::mark();
 
-    markActiveObjectsForContext(*globalData(), scriptExecutionContext());
+    JSGlobalData& globalData = *this->globalData();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(impl()->onmessage()))
-        listener->mark();
+    markActiveObjectsForContext(globalData, scriptExecutionContext());
+
+    markDOMObjectWrapper(globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(globalData, impl()->optionalNavigator());
+
+    markIfNotNull(impl()->onmessage());
 
     typedef WorkerContext::EventListenersMap EventListenersMap;
     typedef WorkerContext::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = impl()->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSWorkerContext::self(ExecState*) const
+bool JSWorkerContext::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
+        return true;
+    return false;
+}
+
+JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
 {
-    return asValue();
+    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
 }
 
-void JSWorkerContext::setSelf(ExecState* exec, JSValuePtr value)
+JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 {
-    putDirect(Identifier(exec, "self"), value);
+    if (!args.size())
+        return jsUndefined();
+
+    Vector<String> urls;
+    for (unsigned i = 0; i < args.size(); i++) {
+        urls.append(args.at(i).toString(exec));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+    ExceptionCode ec = 0;
+    int signedLineNumber;
+    intptr_t sourceID;
+    UString sourceURL;
+    JSValue function;
+    exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, sourceURL, function);
+
+    impl()->importScripts(urls, sourceURL, signedLineNumber >= 0 ? signedLineNumber : 0, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
 }
 
-JSValuePtr JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
 {
-    RefPtr<JSUnprotectedEventListener> listener = findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSUnprotectedEventListener* listener = findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
+{
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setTimeout(action, delay));
+}
+
+JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
+{
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setInterval(action, delay));
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
index bb40705..f4d3033 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,44 +41,39 @@ void JSWorker::mark()
 {
     DOMObject::mark();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onmessage()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        listener->mark();
+    markIfNotNull(m_impl->onmessage());
+    markIfNotNull(m_impl->onerror());
 
     typedef Worker::EventListenersMap EventListenersMap;
     typedef Worker::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSWorker::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSWorker::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorker::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index d7f54de..65cdfc2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -28,22 +28,29 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestConstructor);
 
 const ClassInfo JSXMLHttpRequestConstructor::s_info = { "XMLHttpRequestConstructor", 0, 0, 0 };
 
-JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSXMLHttpRequestConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec, exec->lexicalGlobalObject()), None);
+}
 
-    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec), None);
+ScriptExecutionContext* JSXMLHttpRequestConstructor::scriptExecutionContext() const
+{
+    return m_globalObject->scriptExecutionContext();
 }
 
 static JSObject* constructXMLHttpRequest(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(static_cast<JSXMLHttpRequestConstructor*>(constructor)->document());
+    ScriptExecutionContext* context = static_cast<JSXMLHttpRequestConstructor*>(constructor)->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "XMLHttpRequest constructor associated document is unavailable");
+
+    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(context);
     return CREATE_DOM_OBJECT_WRAPPER(exec, XMLHttpRequest, xmlHttpRequest.get());
 }
 
@@ -56,8 +63,8 @@ ConstructType JSXMLHttpRequestConstructor::getConstructData(ConstructData& const
 void JSXMLHttpRequestConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
index f235af6..978a9f0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
@@ -21,14 +21,13 @@
 #define JSXMLHttpRequestConstructor_h
 
 #include "JSDOMBinding.h"
-#include "JSDocument.h"
 
 namespace WebCore {
 
 class JSXMLHttpRequestConstructor : public DOMObject {
 public:
-    JSXMLHttpRequestConstructor(JSC::ExecState*, ScriptExecutionContext*);
-    Document* document() const { return m_document->impl(); }
+    JSXMLHttpRequestConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+    ScriptExecutionContext* scriptExecutionContext() const;
     static const JSC::ClassInfo s_info;
 
     virtual void mark();
@@ -36,7 +35,7 @@ private:
     virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-    JSDocument* m_document;
+    JSDOMGlobalObject* m_globalObject;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 49813c4..06a5817 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -59,53 +59,40 @@ void JSXMLHttpRequest::mark()
             wrapper->mark();
     }
 
-    if (JSUnprotectedEventListener* onReadyStateChangeListener = static_cast<JSUnprotectedEventListener*>(m_impl->onreadystatechange()))
-        onReadyStateChangeListener->mark();
-
-    if (JSUnprotectedEventListener* onAbortListener = static_cast<JSUnprotectedEventListener*>(m_impl->onabort()))
-        onAbortListener->mark();
-
-    if (JSUnprotectedEventListener* onErrorListener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        onErrorListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadListener = static_cast<JSUnprotectedEventListener*>(m_impl->onload()))
-        onLoadListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadStartListener = static_cast<JSUnprotectedEventListener*>(m_impl->onloadstart()))
-        onLoadStartListener->mark();
-    
-    if (JSUnprotectedEventListener* onProgressListener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
-        onProgressListener->mark();
+    markIfNotNull(m_impl->onreadystatechange());
+    markIfNotNull(m_impl->onabort());
+    markIfNotNull(m_impl->onerror());
+    markIfNotNull(m_impl->onload());
+    markIfNotNull(m_impl->onloadstart());
+    markIfNotNull(m_impl->onprogress());
     
     typedef XMLHttpRequest::EventListenersMap EventListenersMap;
     typedef XMLHttpRequest::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
 // Custom functions
-JSValuePtr JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(exec, 1)->toString(exec));
-    String method = args.at(exec, 0)->toString(exec);
+    const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(1).toString(exec));
+    String method = args.at(0).toString(exec);
     bool async = true;
     if (args.size() >= 3)
-        async = args.at(exec, 2)->toBoolean(exec);
+        async = args.at(2).toBoolean(exec);
 
     ExceptionCode ec = 0;
-    if (args.size() >= 4 && !args.at(exec, 3)->isUndefined()) {
-        String user = valueToStringWithNullCheck(exec, args.at(exec, 3));
+    if (args.size() >= 4 && !args.at(3).isUndefined()) {
+        String user = valueToStringWithNullCheck(exec, args.at(3));
 
-        if (args.size() >= 5 && !args.at(exec, 4)->isUndefined()) {
-            String password = valueToStringWithNullCheck(exec, args.at(exec, 4));
+        if (args.size() >= 5 && !args.at(4).isUndefined()) {
+            String password = valueToStringWithNullCheck(exec, args.at(4));
             impl()->open(method, url, async, user, password, ec);
         } else
             impl()->open(method, url, async, user, ec);
@@ -116,38 +103,38 @@ JSValuePtr JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::setRequestHeader(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::setRequestHeader(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     ExceptionCode ec = 0;
-    impl()->setRequestHeader(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toString(exec), ec);
+    impl()->setRequestHeader(args.at(0).toString(exec), args.at(1).toString(exec), ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     if (args.isEmpty())
         impl()->send(ec);
     else {
-        JSValuePtr val = args.at(exec, 0);
-        if (val->isUndefinedOrNull())
+        JSValue val = args.at(0);
+        if (val.isUndefinedOrNull())
             impl()->send(ec);
-        else if (val->isObject(&JSDocument::s_info))
+        else if (val.isObject(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val->isObject(&JSFile::s_info))
+        else if (val.isObject(&JSFile::s_info))
             impl()->send(toFile(val), ec);
         else
-            impl()->send(val->toString(exec), ec);
+            impl()->send(val.toString(exec), ec);
     }
 
     int signedLineNumber;
     intptr_t sourceID;
     UString sourceURL;
-    JSValuePtr function;
+    JSValue function;
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, sourceURL, function);
     impl()->setLastSendLineNumber(signedLineNumber >= 0 ? signedLineNumber : 0);
     impl()->setLastSendURL(sourceURL);
@@ -156,51 +143,51 @@ JSValuePtr JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::getResponseHeader(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::getResponseHeader(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     ExceptionCode ec = 0;
-    JSValuePtr header = jsStringOrNull(exec, impl()->getResponseHeader(args.at(exec, 0)->toString(exec), ec));
+    JSValue header = jsStringOrNull(exec, impl()->getResponseHeader(args.at(0).toString(exec), ec));
     setDOMException(exec, ec);
     return header;
 }
 
-JSValuePtr JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    impl()->overrideMimeType(args.at(exec, 0)->toString(exec));
+    impl()->overrideMimeType(args.at(0).toString(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::responseText(ExecState* exec) const
+JSValue JSXMLHttpRequest::responseText(ExecState* exec) const
 {
     return jsOwnedStringOrNull(exec, impl()->responseText());
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index 5d094db..597010c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,53 +51,42 @@ void JSXMLHttpRequestUpload::mark()
             wrapper->mark();
     }
 
-    if (JSUnprotectedEventListener* onAbortListener = static_cast<JSUnprotectedEventListener*>(m_impl->onabort()))
-        onAbortListener->mark();
-
-    if (JSUnprotectedEventListener* onErrorListener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        onErrorListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadListener = static_cast<JSUnprotectedEventListener*>(m_impl->onload()))
-        onLoadListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadStartListener = static_cast<JSUnprotectedEventListener*>(m_impl->onloadstart()))
-        onLoadStartListener->mark();
-    
-    if (JSUnprotectedEventListener* onProgressListener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
-        onProgressListener->mark();
+    markIfNotNull(m_impl->onabort());
+    markIfNotNull(m_impl->onerror());
+    markIfNotNull(m_impl->onload());
+    markIfNotNull(m_impl->onloadstart());
+    markIfNotNull(m_impl->onprogress());
     
     typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
     typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
index ed456e1..807b017 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
@@ -37,14 +37,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessorConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessorConstructor);
 
 const ClassInfo JSXSLTProcessorConstructor::s_info = { "XSLTProcessorConsructor", 0, 0, 0 };
 
 JSXSLTProcessorConstructor::JSXSLTProcessorConstructor(ExecState* exec)
     : DOMObject(JSXSLTProcessorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
-    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 static JSObject* constructXSLTProcessor(ExecState* exec, JSObject*, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
index cdd5d1f..01e53a6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -46,10 +46,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSXSLTProcessor::importStylesheet(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::importStylesheet(ExecState*, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    if (nodeVal->isObject(&JSNode::s_info)) {
+    JSValue nodeVal = args.at(0);
+    if (nodeVal.isObject(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         impl()->importStylesheet(node->impl());
         return jsUndefined();
@@ -58,11 +58,11 @@ JSValuePtr JSXSLTProcessor::importStylesheet(ExecState* exec, const ArgList& arg
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    JSValuePtr docVal = args.at(exec, 1);
-    if (nodeVal->isObject(&JSNode::s_info) && docVal->isObject(&JSDocument::s_info)) {
+    JSValue nodeVal = args.at(0);
+    JSValue docVal = args.at(1);
+    if (nodeVal.isObject(&JSNode::s_info) && docVal.isObject(&JSDocument::s_info)) {
         WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
         Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
         return toJS(exec, impl()->transformToFragment(node, doc).get());
@@ -71,10 +71,10 @@ JSValuePtr JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList&
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    if (nodeVal->isObject(&JSNode::s_info)) {
+    JSValue nodeVal = args.at(0);
+    if (nodeVal.isObject(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
         if (resultDocument)
@@ -85,33 +85,33 @@ JSValuePtr JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList&
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::setParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::setParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1)->isUndefinedOrNull() || args.at(exec, 2)->isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull() || args.at(2).isUndefinedOrNull())
         return jsUndefined(); // Throw exception?
-    String namespaceURI = args.at(exec, 0)->toString(exec);
-    String localName = args.at(exec, 1)->toString(exec);
-    String value = args.at(exec, 2)->toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
+    String value = args.at(2).toString(exec);
     impl()->setParameter(namespaceURI, localName, value);
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::getParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::getParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1)->isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull())
         return jsUndefined();
-    String namespaceURI = args.at(exec, 0)->toString(exec);
-    String localName = args.at(exec, 1)->toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
     String value = impl()->getParameter(namespaceURI, localName);
     return jsStringOrUndefined(exec, value);
 }
 
-JSValuePtr JSXSLTProcessor::removeParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::removeParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1)->isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull())
         return jsUndefined();
-    String namespaceURI = args.at(exec, 0)->toString(exec);
-    String localName = args.at(exec, 1)->toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
     impl()->removeParameter(namespaceURI, localName);
     return jsUndefined();
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index d247194..91bece7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -1,8 +1,9 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ *  Copyright (C) 2009 Google Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -32,74 +33,119 @@
 #include "JSDOMWindow.h"
 #include "ScriptController.h"
 #include "ScriptExecutionContext.h"
+#include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include <runtime/JSLock.h>
 
+#if ENABLE(WORKERS)
+#include "JSWorkerContext.h"
+#include "WorkerContext.h"
+#include "WorkerThread.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
-ScheduledAction::ScheduledAction(ExecState* exec, JSValuePtr function, const ArgList& args)
+ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args)
+{
+    JSValue v = args.at(0);
+    CallData callData;
+    if (v.getCallData(callData) == CallTypeNone) {
+        UString string = v.toString(exec);
+        if (exec->hadException())
+            return 0;
+        return new ScheduledAction(string);
+    }
+    ArgList argsTail;
+    args.getSlice(2, argsTail);
+    return new ScheduledAction(v, argsTail);
+}
+
+ScheduledAction::ScheduledAction(JSValue function, const ArgList& args)
     : m_function(function)
 {
     ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it) {
-        m_args.append((*it).jsValue(exec));
-    }
+    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
+        m_args.append(*it);
 }
 
 void ScheduledAction::execute(ScriptExecutionContext* context)
 {
-    // FIXME: make it work with Workers SEC too.
+    if (context->isDocument())
+        execute(static_cast<Document*>(context));
+#if ENABLE(WORKERS)
+    else {
+        ASSERT(context->isWorkerContext());
+        execute(static_cast<WorkerContext*>(context));
+    }
+#else
     ASSERT(context->isDocument());
-    Document* document = static_cast<Document*>(context);
-    if (JSDOMWindow* window = toJSDOMWindow(document->frame()))
-        execute(window->shell());
+#endif
 }
 
-void ScheduledAction::execute(JSDOMWindowShell* windowShell)
+void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSValue thisValue)
 {
-    RefPtr<Frame> frame = windowShell->window()->impl()->frame();
-    if (!frame)
+    ASSERT(m_function);
+    JSLock lock(false);
+
+    CallData callData;
+    CallType callType = m_function.get().getCallData(callData);
+    if (callType == CallTypeNone)
         return;
 
-    if (!frame->script()->isEnabled())
+    ExecState* exec = globalObject->globalExec();
+
+    MarkedArgumentBuffer args;
+    size_t size = m_args.size();
+    for (size_t i = 0; i < size; ++i)
+        args.append(m_args[i]);
+
+    globalObject->globalData()->timeoutChecker.start();
+    call(exec, m_function, callType, callData, thisValue, args);
+    globalObject->globalData()->timeoutChecker.stop();
+
+    if (exec->hadException())
+        reportCurrentException(exec);
+}
+
+void ScheduledAction::execute(Document* document)
+{
+    JSDOMWindow* window = toJSDOMWindow(document->frame());
+    if (!window)
         return;
 
-    frame->script()->setProcessingTimerCallback(true);
+    RefPtr<Frame> frame = window->impl()->frame();
+    if (!frame || !frame->script()->isEnabled())
+        return;
 
-    JSLock lock(false);
+    frame->script()->setProcessingTimerCallback(true);
 
     if (m_function) {
-        CallData callData;
-        CallType callType = m_function->getCallData(callData);
-        if (callType != CallTypeNone) {
-            JSDOMWindow* window = windowShell->window();
-            ExecState* exec = window->globalExec();
-
-            ArgList args;
-            size_t size = m_args.size();
-            for (size_t i = 0; i < size; ++i)
-                args.append(m_args[i]);
-
-            window->startTimeoutCheck();
-            call(exec, m_function, callType, callData, windowShell, args);
-            window->stopTimeoutCheck();
-            if (exec->hadException())
-                reportCurrentException(exec);
-        }
+        executeFunctionInContext(window, window->shell());
+        Document::updateStyleForAllDocuments();
     } else
         frame->loader()->executeScript(m_code);
 
-    // Update our document's rendering following the execution of the timeout callback.
-    // FIXME: Why not use updateDocumentsRendering to update rendering of all documents?
-    // FIXME: Is this really the right point to do the update? We need a place that works
-    // for all possible entry points that might possibly execute script, but this seems
-    // to be a bit too low-level.
-    if (Document* document = frame->document())
-        document->updateRendering();
-
     frame->script()->setProcessingTimerCallback(false);
 }
 
+#if ENABLE(WORKERS)
+void ScheduledAction::execute(WorkerContext* workerContext)
+{
+    // In a Worker, the execution should always happen on a worker thread.
+    ASSERT(workerContext->thread()->threadID() == currentThread());
+
+    WorkerScriptController* scriptController = workerContext->script();
+
+    if (m_function) {
+        JSWorkerContext* contextWrapper = scriptController->workerContextWrapper();
+        executeFunctionInContext(contextWrapper, contextWrapper);
+    } else {
+        ScriptSourceCode code(m_code, workerContext->url());
+        scriptController->evaluate(code);
+    }
+}
+#endif // ENABLE(WORKERS)
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
index 9bf83ad..e7d0b75 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -24,10 +24,15 @@
 #include <runtime/Protect.h>
 #include <wtf/Vector.h>
 
+namespace JSC {
+    class JSGlobalObject;
+}
+
 namespace WebCore {
 
-    class JSDOMWindowShell;
+    class Document;
     class ScriptExecutionContext;
+    class WorkerContext;
 
    /* An action (either function or string) to be executed after a specified
     * time interval, either once or repeatedly. Used for window.setTimeout()
@@ -35,19 +40,25 @@ namespace WebCore {
     */
     class ScheduledAction {
     public:
-        ScheduledAction(JSC::ExecState* exec, JSC::JSValuePtr function, const JSC::ArgList&);
+        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&);
+
+        void execute(ScriptExecutionContext*);
+
+    private:
+        ScheduledAction(JSC::JSValue function, const JSC::ArgList&);
         ScheduledAction(const String& code)
             : m_code(code)
         {
         }
-         
-        void execute(ScriptExecutionContext*);
 
-    private:
-        void execute(JSDOMWindowShell*);
+        void executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue thisValue);
+        void execute(Document*);
+#if ENABLE(WORKERS)        
+        void execute(WorkerContext*);
+#endif
 
-        JSC::ProtectedJSValuePtr m_function;
-        Vector<JSC::ProtectedJSValuePtr> m_args;
+        JSC::ProtectedJSValue m_function;
+        Vector<JSC::ProtectedJSValue> m_args;
         String m_code;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
index eeccf43..213c708 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,7 +30,7 @@
  */
 
 #include "config.h"
-#include "ScriptCachedPageData.h"
+#include "ScriptCachedFrameData.h"
 
 #include "Frame.h"
 #include "GCController.h"
@@ -42,45 +43,46 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptCachedPageData::ScriptCachedPageData(Page* page)
+ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
 {
     JSLock lock(false);
 
-    ScriptController* scriptController = page->mainFrame()->script();
+    ScriptController* scriptController = frame->script();
     if (scriptController->haveWindowShell()) {
         m_window = scriptController->windowShell()->window();
+        scriptController->attachDebugger(0);
     }
 }
 
-DOMWindow* ScriptCachedPageData::domWindow() const {
+DOMWindow* ScriptCachedFrameData::domWindow() const {
     return m_window ? m_window->impl() : 0;
 }
 
-ScriptCachedPageData::~ScriptCachedPageData()
+ScriptCachedFrameData::~ScriptCachedFrameData()
 {
     clear();
 }
 
-void ScriptCachedPageData::restore(Page* page)
+void ScriptCachedFrameData::restore(Frame* frame)
 {
-    Frame* mainFrame = page->mainFrame();
+    Page* page = frame->page();
 
     JSLock lock(false);
 
-    ScriptController* scriptController = mainFrame->script();
+    ScriptController* scriptController = frame->script();
     if (scriptController->haveWindowShell()) {
         JSDOMWindowShell* windowShell = scriptController->windowShell();
         if (m_window) {
             windowShell->setWindow(m_window.get());
         } else {
-            windowShell->setWindow(mainFrame->domWindow());
+            windowShell->setWindow(frame->domWindow());
             scriptController->attachDebugger(page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
         }
     }
 }
 
-void ScriptCachedPageData::clear()
+void ScriptCachedFrameData::clear()
 {
     JSLock lock(false);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
index 91e47d0..c661f28 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,22 +29,22 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptCachedPageData_h
-#define ScriptCachedPageData_h
+#ifndef ScriptCachedFrameData_h
+#define ScriptCachedFrameData_h
 
 #include <runtime/Protect.h>
 
 namespace WebCore {
+    class Frame;
     class JSDOMWindow;
-    class Page;
     class DOMWindow;
 
-    class ScriptCachedPageData  {
+    class ScriptCachedFrameData  {
     public:
-        ScriptCachedPageData(Page*);
-        ~ScriptCachedPageData();
+        ScriptCachedFrameData(Frame*);
+        ~ScriptCachedFrameData();
 
-        void restore(Page*);
+        void restore(Frame*);
         void clear();
         DOMWindow* domWindow() const;
 
@@ -53,4 +54,4 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ScriptCachedPageData_h
+#endif // ScriptCachedFrameData_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
index 29f380a..58168d0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -38,14 +38,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, ExecState* exec, const ArgList& args, unsigned skipArgumentCount)
+ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, const ArgList& args, unsigned skipArgumentCount)
     : m_functionName(functionName)
     , m_sourceURL(urlString)
     , m_lineNumber(lineNumber)
 {
     size_t argumentCount = args.size();
     for (size_t i = skipArgumentCount; i < argumentCount; ++i)
-        m_arguments.append(ScriptValue(args.at(exec, i)));
+        m_arguments.append(ScriptValue(args.at(i)));
 }
 
 ScriptCallFrame::~ScriptCallFrame()
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h
index 64a1a08..b8c0aba 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h
@@ -50,7 +50,7 @@ namespace WebCore {
     // <https://bugs.webkit.org/show_bug.cgi?id=21180>
     class ScriptCallFrame  {
     public:
-        ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, JSC::ExecState*, const JSC::ArgList&, unsigned skipArgumentCount);
+        ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, const JSC::ArgList&, unsigned skipArgumentCount);
         ~ScriptCallFrame();
 
         const ScriptString& functionName() const { return m_functionName; }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
index 88acadb..021ede5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
@@ -50,18 +50,18 @@ ScriptCallStack::ScriptCallStack(ExecState* exec, const ArgList& args, unsigned
     int signedLineNumber;
     intptr_t sourceID;
     UString urlString;
-    JSValuePtr function;
+    JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, urlString, function);
 
     if (function) {
         m_caller = asInternalFunction(function);
         unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, exec, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, args, skipArgumentCount));
     } else {
         // Caller is unknown, but we should still add the frame, because
         // something called us, and gave us arguments.
-        m_frames.append(ScriptCallFrame(UString(), UString(), 0, exec, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(UString(), UString(), 0, args, skipArgumentCount));
     }
 }
 
@@ -90,11 +90,11 @@ void ScriptCallStack::initialize()
     if (!m_caller || m_initialized)
         return;
 
-    JSValuePtr func = m_exec->interpreter()->retrieveCaller(m_exec, m_caller);
-    while (!func->isNull()) {
+    JSValue func = m_exec->interpreter()->retrieveCaller(m_exec, m_caller);
+    while (!func.isNull()) {
         InternalFunction* internalFunction = asInternalFunction(func);
         ArgList emptyArgList;
-        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, 0, emptyArgList, 0));
+        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, emptyArgList, 0));
         func = m_exec->interpreter()->retrieveCaller(m_exec, internalFunction);
     }
     m_initialized = true;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index ebed71d..e570293 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -21,44 +21,34 @@
 #include "config.h"
 #include "ScriptController.h"
 
-#include "Console.h"
-#include "DOMWindow.h"
-#include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "GCController.h"
-#include "JSDOMWindow.h"
+#include "HTMLPlugInElement.h"
 #include "JSDocument.h"
-#include "JSEventListener.h"
-#include "npruntime_impl.h"
 #include "NP_jsobject.h"
 #include "Page.h"
 #include "PageGroup.h"
-#include "runtime_root.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
-
-#include <runtime/Completion.h>
+#include "npruntime_impl.h"
+#include "runtime_root.h"
 #include <debugger/Debugger.h>
 #include <runtime/JSLock.h>
 
-#if ENABLE(NETSCAPE_PLUGIN_API)
-#include "HTMLPlugInElement.h"
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
 
 ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
-    , m_handlerLineno(0)
+    , m_handlerLineNumber(0)
     , m_sourceURL(0)
     , m_processingTimerCallback(false)
     , m_paused(false)
+    , m_allowPopupsFromPlugin(false)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_windowScriptNPObject(0)
 #endif
@@ -106,24 +96,26 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
     JSLock lock(false);
 
+    RefPtr<Frame> protect = m_frame;
+
+    m_windowShell->window()->globalData()->timeoutChecker.start();
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
+    m_windowShell->window()->globalData()->timeoutChecker.stop();
+
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
     m_frame->keepAlive();
 
-    m_windowShell->window()->startTimeoutCheck();
-    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
-    m_windowShell->window()->stopTimeoutCheck();
-
     if (comp.complType() == Normal || comp.complType() == ReturnValue) {
         m_sourceURL = savedSourceURL;
         return comp.value();
     }
 
-    if (comp.complType() == Throw)
+    if (comp.complType() == Throw || comp.complType() == Interrupted)
         reportException(exec, comp.value());
 
     m_sourceURL = savedSourceURL;
-    return noValue();
+    return JSValue();
 }
 
 void ScriptController::clearWindowShell()
@@ -132,9 +124,13 @@ void ScriptController::clearWindowShell()
         return;
 
     JSLock lock(false);
-    m_windowShell->window()->clear();
-    m_liveFormerWindows.add(m_windowShell->window());
+
+    // Clear the debugger from the current window before setting the new window.
+    attachDebugger(0);
+
+    m_windowShell->window()->willRemoveFromWindowShell();
     m_windowShell->setWindow(m_frame->domWindow());
+
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
         m_windowShell->window()->setProfileGroup(page->group().identifier());
@@ -144,22 +140,6 @@ void ScriptController::clearWindowShell()
     gcController().garbageCollectSoon();
 }
 
-PassRefPtr<EventListener> ScriptController::createInlineEventListener(const String& functionName, const String& code, Node* node)
-{
-    initScriptIfNeeded();
-    JSLock lock(false);
-    return JSLazyEventListener::create(JSLazyEventListener::HTMLLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
-}
-
-#if ENABLE(SVG)
-PassRefPtr<EventListener> ScriptController::createSVGEventHandler(const String& functionName, const String& code, Node* node)
-{
-    initScriptIfNeeded();
-    JSLock lock(false);
-    return JSLazyEventListener::create(JSLazyEventListener::SVGLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
-}
-#endif
-
 void ScriptController::initScript()
 {
     if (m_windowShell)
@@ -168,7 +148,7 @@ void ScriptController::initScript()
     JSLock lock(false);
 
     m_windowShell = new JSDOMWindowShell(m_frame->domWindow());
-    updateDocument();
+    m_windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
@@ -180,6 +160,11 @@ void ScriptController::initScript()
 
 bool ScriptController::processingUserGesture() const
 {
+    return m_allowPopupsFromPlugin || processingUserGestureEvent() || isJavaScriptAnchorNavigation();
+}
+
+bool ScriptController::processingUserGestureEvent() const
+{
     if (!m_windowShell)
         return false;
 
@@ -196,13 +181,37 @@ bool ScriptController::processingUserGesture() const
             type == eventNames().focusEvent || type == eventNames().blurEvent ||
             type == eventNames().submitEvent)
             return true;
-    } else { // no event
-        if (m_sourceURL && m_sourceURL->isNull() && !m_processingTimerCallback) {
-            // This is the <a href="javascript:window.open('...')> case -> we let it through
-            return true;
+    }
+    
+    return false;
+}
+
+// FIXME: This seems like an insufficient check to verify a click on a javascript: anchor.
+bool ScriptController::isJavaScriptAnchorNavigation() const
+{
+    // This is the <a href="javascript:window.open('...')> case -> we let it through
+    if (m_sourceURL && m_sourceURL->isNull() && !m_processingTimerCallback)
+        return true;
+
+    // This is the <script>window.open(...)</script> case or a timer callback -> block it
+    return false;
+}
+
+bool ScriptController::anyPageIsProcessingUserGesture() const
+{
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
+
+    const HashSet<Page*>& pages = page->group().pages();
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->script()->processingUserGesture())
+                return true;
         }
-        // This is the <script>window.open(...)</script> case or a timer callback -> block it
     }
+
     return false;
 }
 
@@ -231,9 +240,6 @@ void ScriptController::updateDocument()
     JSLock lock(false);
     if (m_windowShell)
         m_windowShell->window()->updateDocument();
-    HashSet<JSDOMWindow*>::iterator end = m_liveFormerWindows.end();
-    for (HashSet<JSDOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
-        (*it)->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -266,6 +272,7 @@ PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* native
 }
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
+
 NPObject* ScriptController::windowScriptNPObject()
 {
     if (!m_windowScriptNPObject) {
@@ -289,23 +296,34 @@ NPObject* ScriptController::windowScriptNPObject()
 
 NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)
 {
-    // Can't create NPObjects when JavaScript is disabled
-    if (!isEnabled())
+    JSObject* object = jsObjectForPluginElement(plugin);
+    if (!object)
         return _NPN_CreateNoScriptObject();
 
+    // Wrap the JSObject in an NPObject
+    return _NPN_CreateScriptObject(0, object, bindingRootObject());
+}
+
+#endif
+
+JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
+{
+    // Can't create JSObjects when JavaScript is disabled
+    if (!isEnabled())
+        return 0;
+
     // Create a JSObject bound to this element
     JSLock lock(false);
     ExecState* exec = globalObject()->globalExec();
-    JSValuePtr jsElementValue = toJS(exec, plugin);
-    if (!jsElementValue || !jsElementValue->isObject())
-        return _NPN_CreateNoScriptObject();
-
-    // Wrap the JSObject in an NPObject
-    return _NPN_CreateScriptObject(0, jsElementValue->getObject(), bindingRootObject());
+    JSValue jsElementValue = toJS(exec, plugin);
+    if (!jsElementValue || !jsElementValue.isObject())
+        return 0;
+    
+    return jsElementValue.getObject();
 }
-#endif
 
 #if !PLATFORM(MAC)
+
 void ScriptController::updatePlatformScriptObjects()
 {
 }
@@ -313,6 +331,7 @@ void ScriptController::updatePlatformScriptObjects()
 void ScriptController::disconnectPlatformScriptObjects()
 {
 }
+
 #endif
 
 void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index c952cc2..f700cd9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -81,14 +81,12 @@ public:
 
     ScriptValue evaluate(const ScriptSourceCode&);
 
-    PassRefPtr<EventListener> createInlineEventListener(const String& functionName, const String& code, Node*);
-#if ENABLE(SVG)
-    PassRefPtr<EventListener> createSVGEventHandler(const String& functionName, const String& code, Node*);
-#endif
-    void setEventHandlerLineno(int lineno) { m_handlerLineno = lineno; }
+    void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
+    int eventHandlerLineNumber() { return m_handlerLineNumber; }
 
     void setProcessingTimerCallback(bool b) { m_processingTimerCallback = b; }
     bool processingUserGesture() const;
+    bool anyPageIsProcessingUserGesture() const;
 
     bool isEnabled();
 
@@ -97,10 +95,12 @@ public:
     void setPaused(bool b) { m_paused = b; }
     bool isPaused() const { return m_paused; }
 
+    void setAllowPopupsFromPlugin(bool allowPopupsFromPlugin) { m_allowPopupsFromPlugin = allowPopupsFromPlugin; }
+    bool allowPopupsFromPlugin() const { return m_allowPopupsFromPlugin; }
+    
     const String* sourceURL() const { return m_sourceURL; } // 0 if we are not evaluating any script
 
     void clearWindowShell();
-    void clearFormerWindow(JSDOMWindow* window) { m_liveFormerWindows.remove(window); }
     void updateDocument();
 
     // Notifies the ScriptController that the securityOrigin of the current
@@ -126,6 +126,8 @@ public:
     WebScriptObject* windowScriptObject();
 #endif
 
+    JSC::JSObject* jsObjectForPluginElement(HTMLPlugInElement*);
+    
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
     NPObject* windowScriptNPObject();
@@ -141,14 +143,17 @@ private:
 
     void disconnectPlatformScriptObjects();
 
+    bool processingUserGestureEvent() const;
+    bool isJavaScriptAnchorNavigation() const;
+
     JSC::ProtectedPtr<JSDOMWindowShell> m_windowShell;
-    HashSet<JSDOMWindow*> m_liveFormerWindows;
     Frame* m_frame;
-    int m_handlerLineno;
+    int m_handlerLineNumber;
     const String* m_sourceURL;
 
     bool m_processingTimerCallback;
     bool m_paused;
+    bool m_allowPopupsFromPlugin;
 
     // The root object used for objects bound outside the context of a plugin.
     RefPtr<JSC::Bindings::RootObject> m_bindingRootObject;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
index 39fcc67..502a504 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
@@ -57,6 +57,7 @@
 @interface NSObject (WebPlugin)
 - (id)objectForWebScript;
 - (NPObject *)createPluginScriptableObject;
+- (PassRefPtr<JSC::Bindings::Instance>)createPluginBindingsInstance:(PassRefPtr<JSC::Bindings::RootObject>)rootObject;
 @end
 
 using namespace JSC::Bindings;
@@ -71,6 +72,9 @@ PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widge
 
     RefPtr<RootObject> rootObject = createRootObject(widgetView);
 
+    if ([widgetView respondsToSelector:@selector(createPluginBindingsInstance:)])
+        return [widgetView createPluginBindingsInstance:rootObject.release()];
+        
     if ([widgetView respondsToSelector:@selector(objectForWebScript)]) {
         id objectForWebScript = [widgetView objectForWebScript];
         if (!objectForWebScript)
@@ -137,7 +141,7 @@ void ScriptController::disconnectPlatformScriptObjects()
 
 static pthread_t mainThread;
 
-static void updateRenderingForBindings(JSC::ExecState*, JSC::JSObject* rootObject)
+static void updateStyleIfNeededForBindings(JSC::ExecState*, JSC::JSObject* rootObject)
 {
     if (pthread_self() != mainThread)
         return;
@@ -153,18 +157,14 @@ static void updateRenderingForBindings(JSC::ExecState*, JSC::JSObject* rootObjec
     if (!frame)
         return;
 
-    Document* document = frame->document();
-    if (!document)
-        return;
-
-    document->updateRendering();
+    frame->document()->updateStyleIfNeeded();
 }
 
 void ScriptController::initJavaJSBindings()
 {
     mainThread = pthread_self();
     JSC::Bindings::JavaJSObject::initializeJNIThreading();
-    JSC::Bindings::Instance::setDidExecuteFunction(updateRenderingForBindings);
+    JSC::Bindings::Instance::setDidExecuteFunction(updateStyleIfNeededForBindings);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
new file mode 100644
index 0000000..0ce7bca
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptEventListener.h"
+
+#include "Attribute.h"
+#include "Document.h"
+#include "JSNode.h"
+#include "Frame.h"
+
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static const String& eventParameterName(bool isSVGEvent)
+{
+    DEFINE_STATIC_LOCAL(const String, eventString, ("event"));
+    DEFINE_STATIC_LOCAL(const String, evtString, ("evt"));
+    return isSVGEvent ? evtString : eventString;
+}
+
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
+{
+    ASSERT(node);
+
+    Frame* frame = node->document()->frame();
+    if (!frame)
+        return 0;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return 0;
+
+    JSDOMWindow* globalObject = scriptController->globalObject();
+
+    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+    {
+        JSLock lock(false);
+        toJS(globalObject->globalExec(), node);
+    }
+
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), globalObject, node, scriptController->eventHandlerLineNumber());
+}
+
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
+{
+    if (!frame)
+        return 0;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return 0;
+
+    // 'globalObject' is the JavaScript wrapper that will mark the event listener we're creating.
+    JSDOMWindow* globalObject = scriptController->globalObject();
+
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), globalObject, 0, scriptController->eventHandlerLineNumber());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.h
new file mode 100644
index 0000000..8299d29
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptEventListener_h
+#define ScriptEventListener_h
+
+#include "JSLazyEventListener.h"
+
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class Attribute;
+    class Frame;
+    class Node;
+
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node*, Attribute*);
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+
+} // namespace WebCore
+
+#endif // ScriptEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
new file mode 100644
index 0000000..1122931
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptFunctionCall.h"
+
+#include "JSDOMBinding.h"
+#include "ScriptString.h"
+#include "ScriptValue.h"
+
+#include <runtime/JSLock.h>
+#include <runtime/UString.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name)
+    : m_exec(exec)
+    , m_thisObject(thisObject)
+    , m_name(name)
+{
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptObject& argument)
+{
+    m_arguments.append(argument.jsObject());
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptString& argument)
+{
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptValue& argument)
+{
+    m_arguments.append(argument.jsValue());
+}
+
+void ScriptFunctionCall::appendArgument(const String& argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(const JSC::UString& argument)
+{
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(JSC::JSValue argument)
+{
+    m_arguments.append(argument);
+}
+
+void ScriptFunctionCall::appendArgument(long long argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(unsigned int argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(int argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(bool argument)
+{
+    m_arguments.append(jsBoolean(argument));
+}
+
+ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
+{
+    JSObject* thisObject = m_thisObject.jsObject();
+
+    JSLock lock(false);
+
+    JSValue function = thisObject->get(m_exec, Identifier(m_exec, m_name));
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptValue();
+    }
+
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return ScriptValue();
+
+    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptValue();
+    }
+
+    return ScriptValue(result);
+}
+
+ScriptValue ScriptFunctionCall::call()
+{
+    bool hadException = false;
+    return call(hadException);
+}
+
+ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExceptions)
+{
+    JSObject* thisObject = m_thisObject.jsObject();
+
+    JSLock lock(false);
+
+    JSObject* constructor = asObject(thisObject->get(m_exec, Identifier(m_exec, m_name)));
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptObject();
+    }
+
+    ConstructData constructData;
+    ConstructType constructType = constructor->getConstructData(constructData);
+    if (constructType == ConstructTypeNone)
+        return ScriptObject();
+
+    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptObject();
+    }
+
+    return ScriptObject(asObject(result));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
new file mode 100644
index 0000000..079ac21
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptFunctionCall_h
+#define ScriptFunctionCall_h
+
+#include "PlatformString.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <runtime/ArgList.h>
+
+namespace JSC {
+    class UString;
+    class JSValue;
+}
+
+namespace WebCore {
+    class ScriptValue;
+    class ScriptString;
+
+    class ScriptFunctionCall {
+    public:
+        ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name);
+        virtual ~ScriptFunctionCall() {};
+
+        void appendArgument(const ScriptObject&);
+        void appendArgument(const ScriptString&);
+        void appendArgument(const ScriptValue&);
+        void appendArgument(const String&);
+        void appendArgument(const JSC::UString&);
+        void appendArgument(JSC::JSValue);
+        void appendArgument(long long);
+        void appendArgument(unsigned int);
+        void appendArgument(int);
+        void appendArgument(bool);
+        ScriptValue call(bool& hadException, bool reportExceptions = true);
+        ScriptValue call();
+        ScriptObject construct(bool& hadException, bool reportExceptions = true);
+
+    protected:
+        ScriptState* m_exec;
+        ScriptObject m_thisObject;
+        String m_name;
+        JSC::MarkedArgumentBuffer m_arguments;
+    };
+
+} // namespace WebCore
+
+#endif // ScriptFunctionCall
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
new file mode 100644
index 0000000..7f6391d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptObject.h"
+
+#include "JSDOMBinding.h"
+#include "JSInspectorController.h"
+
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptObject::ScriptObject(JSObject* object)
+    : ScriptValue(object)
+{
+}
+
+static bool handleException(ScriptState* scriptState)
+{
+    if (!scriptState->hadException())
+        return true;
+
+    reportException(scriptState, scriptState->exception());
+    return false;
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const String& name, const String& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), value.jsObject(), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const String& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, double value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, long long value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, int value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, bool value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsBoolean(value), slot);
+    return handleException(scriptState);
+}
+
+ScriptObject ScriptObject::createNew(ScriptState* scriptState)
+{
+    JSLock lock(false);
+    return ScriptObject(constructEmptyObject(scriptState));
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->putDirect(Identifier(scriptState, name), value.jsObject());
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorController* value)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->putDirect(Identifier(scriptState, name), toJS(scriptState, value));
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
+{
+    JSLock lock(false);
+    JSValue jsValue = scriptState->lexicalGlobalObject()->get(scriptState, Identifier(scriptState, name));
+    if (!jsValue)
+        return false;
+
+    if (!jsValue.isObject())
+        return false;
+
+    value = ScriptObject(asObject(jsValue));
+    return true;
+}
+
+bool ScriptGlobalObject::remove(ScriptState* scriptState, const char* name)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->deleteProperty(scriptState, Identifier(scriptState, name));
+    return handleException(scriptState);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
new file mode 100644
index 0000000..ed86659
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptObject_h
+#define ScriptObject_h
+
+#include "ScriptState.h"
+#include "ScriptValue.h"
+
+#include <runtime/JSObject.h>
+#include <runtime/Protect.h>
+
+namespace WebCore {
+    class InspectorController;
+
+    class ScriptObject : public ScriptValue {
+    public:
+        ScriptObject(JSC::JSObject*);
+        ScriptObject() {}
+        JSC::JSObject* jsObject() const { return asObject(jsValue()); }
+
+        bool set(ScriptState*, const String& name, const String&);
+        bool set(ScriptState*, const char* name, const ScriptObject&);
+        bool set(ScriptState*, const char* name, const String&);
+        bool set(ScriptState*, const char* name, double);
+        bool set(ScriptState*, const char* name, long long);
+        bool set(ScriptState*, const char* name, int);
+        bool set(ScriptState*, const char* name, bool);
+
+        static ScriptObject createNew(ScriptState*);
+    };
+
+    class ScriptGlobalObject {
+    public:
+        static bool set(ScriptState*, const char* name, const ScriptObject&);
+        static bool set(ScriptState*, const char* name, InspectorController*);
+        static bool get(ScriptState*, const char* name, ScriptObject&);
+        static bool remove(ScriptState*, const char* name);
+    private:
+        ScriptGlobalObject() { }
+    };
+
+}
+
+#endif // ScriptObject_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
new file mode 100644
index 0000000..13e180a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptObjectQuarantine.h"
+
+#include "Database.h"
+#include "Document.h"
+#include "Frame.h"
+#include "JSDOMBinding.h"
+#include "JSInspectedObjectWrapper.h"
+#include "JSNode.h"
+#include "ScriptObject.h"
+#include "ScriptValue.h"
+
+#include <runtime/JSLock.h>
+
+#if ENABLE(DATABASE)
+#include "JSDatabase.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "JSStorage.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
+{
+    JSLock lock(false);
+    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
+}
+
+#if ENABLE(DATABASE)
+bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
+{
+    ASSERT(database);
+
+    Frame* frame = database->document()->frame();
+    if (!frame)
+        return false;
+
+    ExecState* exec = toJSDOMWindow(frame)->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, database))));
+
+    return true;
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+{
+    ASSERT(frame);
+    ASSERT(storage);
+
+    ExecState* exec = toJSDOMWindow(frame)->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, storage))));
+
+    return true;
+}
+#endif
+
+bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
+{
+    ExecState* exec = scriptStateFromNode(node);
+    if (!exec)
+        return false;
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, node))));
+
+    return true;
+}
+
+bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
+{
+    ASSERT(domWindow);
+
+    JSDOMWindow* window = toJSDOMWindow(domWindow->frame());
+    ExecState* exec = window->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, window)));
+
+    return true;
+}
+
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
new file mode 100644
index 0000000..d70acd7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptObjectQuarantine_h
+#define ScriptObjectQuarantine_h
+
+#include "ScriptState.h"
+
+namespace WebCore {
+
+    class Database;
+    class DOMWindow;
+    class Frame;
+    class Node;
+    class ScriptObject;
+    class ScriptValue;
+    class Storage;
+
+    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+
+#if ENABLE(DATABASE)
+    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
+#endif
+#if ENABLE(DOM_STORAGE)
+    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+#endif
+    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+
+}
+
+#endif // ScriptObjectQuarantine_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
new file mode 100644
index 0000000..8bfa33d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptState.h"
+
+#include "Frame.h"
+#include "Node.h"
+#include "Page.h"
+
+namespace WebCore {
+
+ScriptState* scriptStateFromNode(Node* node)
+{
+    if (!node)
+        return 0;
+    Document* document = node->document();
+    if (!document)
+        return 0;
+    Frame* frame = document->frame();
+    if (!frame)
+        return 0;
+    if (!frame->script()->isEnabled())
+        return 0;
+    return frame->script()->globalObject()->globalExec();
+}
+
+ScriptState* scriptStateFromPage(Page* page)
+{
+    return page->mainFrame()->script()->globalObject()->globalExec();
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
index 3cce093..fa5c4a8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
@@ -32,11 +32,11 @@
 #ifndef ScriptState_h
 #define ScriptState_h
 
-namespace JSC {
-    class ExecState;
-}
+#include "JSDOMBinding.h"
 
 namespace WebCore {
+    class Node;
+    class Page;
 
     // The idea is to expose "state-like" methods (hadException, and any other
     // methods where ExecState just dips into globalData) of JSC::ExecState as a
@@ -44,6 +44,9 @@ namespace WebCore {
     // For now, the separation is purely by convention.
     typedef JSC::ExecState ScriptState;
 
+    ScriptState* scriptStateFromNode(Node*);
+    ScriptState* scriptStateFromPage(Page*);
+
 } // namespace WebCore
 
 #endif // ScriptState_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
index 3efa160..6dab9a0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
@@ -32,7 +32,6 @@
 #define ScriptString_h
 
 #include "PlatformString.h"
-#include <runtime/JSLock.h>
 #include <runtime/UString.h>
 
 namespace WebCore {
@@ -52,27 +51,23 @@ public:
 
     ScriptString& operator=(const char* s)
     {
-        JSC::JSLock lock(false);
         m_str = s;
         return *this;
     }
 
     ScriptString& operator+=(const String& s)
     {
-        JSC::JSLock lock(false);
         m_str += s;
         return *this;
     }
 
     bool operator==(const ScriptString& s) const
     {
-        JSC::JSLock lock(false);
         return m_str == s.m_str;
     }
 
     bool operator!=(const ScriptString& s) const
     {
-        JSC::JSLock lock(false);
         // Avoid exporting an extra symbol by re-using "==" operator.
         return !(m_str == s.m_str);
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
index f462e21..dfb46da 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
@@ -29,7 +29,9 @@
 #include "config.h"
 #include "ScriptValue.h"
 
-#include "PlatformString.h"
+#include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSValueRef.h>
+
 #include <runtime/JSLock.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
@@ -44,24 +46,32 @@ bool ScriptValue::getString(String& result) const
         return false;
     JSLock lock(false);
     UString ustring;
-    if (!m_value->getString(ustring))
+    if (!m_value.get().getString(ustring))
         return false;
     result = ustring;
     return true;
 }
 
+bool ScriptValue::isEqual(ScriptState* scriptState, const ScriptValue& anotherValue) const
+{
+    if (hasNoValue())
+        return anotherValue.hasNoValue();
+
+    return JSValueIsEqual(toRef(scriptState), toRef(scriptState, jsValue()), toRef(scriptState, anotherValue.jsValue()), 0);
+}
+
 bool ScriptValue::isNull() const
 {
     if (!m_value)
         return false;
-    return m_value->isNull();
+    return m_value.get().isNull();
 }
 
 bool ScriptValue::isUndefined() const
 {
     if (!m_value)
         return false;
-    return m_value->isUndefined();
+    return m_value.get().isUndefined();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
index 855509a..209ce06 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
@@ -31,6 +31,8 @@
 #ifndef ScriptValue_h
 #define ScriptValue_h
 
+#include "PlatformString.h"
+#include "ScriptState.h"
 #include <runtime/Protect.h>
 
 namespace WebCore {
@@ -39,15 +41,19 @@ class String;
 
 class ScriptValue {
 public:
-    ScriptValue(JSC::JSValuePtr value = JSC::noValue()) : m_value(value) {}
+    ScriptValue(JSC::JSValue value = JSC::JSValue()) : m_value(value) {}
+    virtual ~ScriptValue() {}
 
-    JSC::JSValuePtr jsValue() const { return m_value.get(); }
+    JSC::JSValue jsValue() const { return m_value.get(); }
     bool getString(String& result) const;
+    String toString(ScriptState* scriptState) const { return m_value.get().toString(scriptState); }
+    bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
+    bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
 private:
-    JSC::ProtectedJSValuePtr m_value;
+    JSC::ProtectedJSValue m_value;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index 0727510..dd391bc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -35,7 +35,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "WorkerContext.h"
-#include "WorkerMessagingProxy.h"
+#include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
 #include <interpreter/Interpreter.h>
 #include <runtime/Completion.h>
@@ -68,8 +68,13 @@ void WorkerScriptController::initScript()
 
     JSLock lock(false);
 
+    // Explicitly protect the global object's prototype so it isn't collected
+    // when we allocate the global object. (Once the global object is fully
+    // constructed, it can mark its own prototype.)
     RefPtr<Structure> prototypeStructure = JSWorkerContextPrototype::createStructure(jsNull());
-    RefPtr<Structure> structure = JSWorkerContext::createStructure(new (m_globalData.get()) JSWorkerContextPrototype(prototypeStructure.release()));
+    ProtectedPtr<JSWorkerContextPrototype> prototype = new (m_globalData.get()) JSWorkerContextPrototype(prototypeStructure.release());
+
+    RefPtr<Structure> structure = JSWorkerContext::createStructure(prototype);
     m_workerContextWrapper = new (m_globalData.get()) JSWorkerContext(structure.release(), m_workerContext);
 }
 
@@ -78,25 +83,46 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
     {
         MutexLocker lock(m_sharedDataMutex);
         if (m_executionForbidden)
-            return noValue();
+            return JSValue();
+    }
+    ScriptValue exception;
+    ScriptValue result = evaluate(sourceCode, &exception);
+    if (exception.jsValue()) {
+        JSLock lock(false);
+        reportException(m_workerContextWrapper->globalExec(), exception.jsValue());
+    }
+    return result;
+}
+
+ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode, ScriptValue* exception)
+{
+    {
+        MutexLocker lock(m_sharedDataMutex);
+        if (m_executionForbidden)
+            return JSValue();
     }
 
     initScriptIfNeeded();
     JSLock lock(false);
 
     ExecState* exec = m_workerContextWrapper->globalExec();
-    m_workerContextWrapper->startTimeoutCheck();
+    m_workerContextWrapper->globalData()->timeoutChecker.start();
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
-    m_workerContextWrapper->stopTimeoutCheck();
+    m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
-    m_workerContext->thread()->messagingProxy()->reportWorkerThreadActivity(m_workerContext->hasPendingActivity());
+    m_workerContext->thread()->workerObjectProxy()->reportPendingActivity(m_workerContext->hasPendingActivity());
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
         return comp.value();
 
     if (comp.complType() == Throw)
-        reportException(exec, comp.value());
-    return noValue();
+        *exception = comp.value();
+    return JSValue();
+}
+
+void WorkerScriptController::setException(ScriptValue exception)
+{
+    m_workerContextWrapper->globalExec()->setException(exception.jsValue());
 }
 
 void WorkerScriptController::forbidExecution()
@@ -107,7 +133,7 @@ void WorkerScriptController::forbidExecution()
     // It is not critical for Interpreter::m_timeoutTime to be synchronized, we just rely on it reaching the worker thread's processor sooner or later.
     MutexLocker lock(m_sharedDataMutex);
     m_executionForbidden = true;
-    m_globalData->interpreter->setTimeoutTime(1); // 1 ms is the smallest timeout that can be set.
+    m_globalData->timeoutChecker.setTimeoutInterval(1); // 1ms is the smallest timeout that can be set.
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
index 1dda5da..0454721 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
@@ -57,9 +57,11 @@ namespace WebCore {
         }
 
         ScriptValue evaluate(const ScriptSourceCode&);
+        ScriptValue evaluate(const ScriptSourceCode&, ScriptValue* exception);
 
-        void forbidExecution();
+        void setException(ScriptValue);
 
+        void forbidExecution();
     private:
         void initScriptIfNeeded()
         {