Updated WebKit from /home/joce/dev/qtwebkit/ to qtwebkit-4.6-snapshot-18092009 ( 15c07fb8d7fa5e93c939aa7eb21c06e19c754cee )

Changes in WebKit/qt since the last update: ++ b/WebKit/qt/ChangeLog 2009-09-17 Janne Koskinen <janne.p.koskinen@digia.com> Reviewed by Simon Hausmann. Symbian build fix. Moved the #ifdefs around _q_cleanupLeakMessages() into the function definition. QMake is not being able to distinguish between release and debug builds in Symbian build. This is a Symbian toolchain issue. * Api/qwebpage.cpp: (QWebPagePrivate::_q_cleanupLeakMessages): * Api/qwebpage.h: * Api/qwebpage_p.h: 2009-09-17 Jocelyn Turcotte <jocelyn.turcotte@nokia.com> Reviewed by Simon Hausmann. Small cosmetic documentation fixlet in the QWebInspector. * Api/qwebinspector.cpp: 2009-09-16 Benjamin C Meyer <benjamin.meyer@torchmobile.com> Reviewed by Eric Seidel. Detect and add Windows7 properly to the user agent. * Api/qwebpage.cpp: (QWebPage::userAgentForUrl): 2009-09-16 Andras Becsi <andrewbecsi@yahoo.co.uk> Rubberstamped by Kenneth Christiansen. [Qt] Build fix for previous changes. * QGVLauncher/main.cpp: (MainView::flip): 2009-09-16 Kenneth Rohde Christiansen <kenneth@webkit.org> Unreviewed potential Qt < 4.6 build fix. * QGVLauncher/main.cpp: (MainView::flip): 2009-09-16 Kenneth Rohde Christiansen <kenneth@webkit.org> Reviewed by Simon Hausmann. Add a "Flip effect" to our GraphicsView based launcher. * QGVLauncher/main.cpp: (MainView::resizeEvent): (MainView::flip): (MainWindow::flip): (MainWindow::buildUI): 2009-09-16 Zoltan Herczeg <zherczeg@inf.u-szeged.hu> Rubber-stamped by Simon Hausmann. [Qt] Typo fix. Pass the window object to the Format menu. In this way Qt can free its internal graphical objects during exit. * QtLauncher/main.cpp: (MainWindow::setupUI): 2009-09-16 Jocelyn Turcotte <jocelyn.turcotte@nokia.com> Reviewed by Tor Arne Vestbø. [Qt] Build break fix on gcc ARM. * Api/qwebgraphicsitem.cpp: (QWebGraphicsItemPrivate::_q_doLoadProgress): 2009-09-16 Warwick Allison <warwick.allison@nokia.com> Reviewed by Simon Hausmann. Fix a crash in QWebFrame::hasFocus() with a simple null pointer check when the focused frame is null. We do the same check in other places where we call kit(). * Api/qwebframe.cpp: (QWebFrame::hasFocus): 2009-09-16 Jure Repinc <jlp@holodeck1.com> Reviewed by Simon Hausmann. Fixed a typo found during translation. * WebCoreSupport/FrameLoaderClientQt.cpp: (WebCore::FrameLoaderClientQt::interruptForPolicyChangeError): 2009-09-14 Jakub Wieczorek <faw217@gmail.com> Reviewed by Simon Hausmann. [Qt] QWebGraphicsItem should check for null QWebPage. https://bugs.webkit.org/show_bug.cgi?id=29185 Don't crash in QWebGraphicsItem when the page is still null, by either checking if it's the case or constructing the default one. * Api/qwebgraphicsitem.cpp: (QWebGraphicsItem::icon): (QWebGraphicsItem::setZoomFactor): (QWebGraphicsItem::zoomFactor): (QWebGraphicsItem::setGeometry): (QWebGraphicsItem::load): (QWebGraphicsItem::setHtml): (QWebGraphicsItem::toHtml): (QWebGraphicsItem::setContent): (QWebGraphicsItem::history): (QWebGraphicsItem::settings): 2009-09-11 David Boddie <dboddie@trolltech.com> Reviewed by Simon Hausmann. Doc: Note that Netscape plugins are only available on desktop platforms. * docs/qtwebkit.qdoc: 2009-09-11 Martin Smith <msmith@trolltech.com> Reviewed by Simon Hausmann. Adjust the name of the contentspage for the documentation to the new name used in Qt 4.6. * docs/qtwebkit.qdoc: 2009-09-11 Ariya Hidayat <ariya.hidayat@nokia.com> Reviewed by Simon Hausmann. Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general renaming. * Api/qwebpluginfactory.cpp: * docs/webkitsnippets/simple/main.cpp: (main): * docs/webkitsnippets/webpage/main.cpp: (main): 2009-09-11 Volker Hilsheimer <volker.hilsheimer@nokia.com> Reviewed by Simon Hausmann. Restructure the documentation, both on a file and on a content level. * Api/qwebdatabase.cpp: * Api/qwebelement.cpp: * Api/qwebframe.cpp: * Api/qwebhistory.cpp: * Api/qwebhistoryinterface.cpp: * Api/qwebpage.cpp: * Api/qwebpluginfactory.cpp: * Api/qwebsecurityorigin.cpp: * Api/qwebsettings.cpp: * Api/qwebview.cpp: * docs/qtwebkit.qdoc: 2009-09-11 Yongjun Zhang <yongjun.zhang@nokia.com> Reviewed by Simon Hausmann. https://bugs.webkit.org/show_bug.cgi?id=29136 [Qt] emit microFocusChanged() signal when no QWidget-based view is present. emit microFocusChange() signal regardless of view. * WebCoreSupport/EditorClientQt.cpp: (WebCore::EditorClientQt::setInputMethodState): 2009-09-11 Jocelyn Turcotte <jocelyn.turcotte@nokia.com> Reviewed by Simon Hausmann. https://bugs.webkit.org/show_bug.cgi?id=28806 [Qt] Make the WebInspector available as a QWidget. * Api/headers.pri: * Api/qwebelement.cpp: (QWebElement::enclosingElement): * Api/qwebelement.h: * Api/qwebinspector.cpp: Added. * Api/qwebinspector.h: Added. * Api/qwebinspector_p.h: Added. * Api/qwebpage.cpp: (QWebPagePrivate::QWebPagePrivate): (QWebPagePrivate::setInspector): (QWebPagePrivate::getOrCreateInspector): (QWebPagePrivate::inspectorController): (QWebPage::~QWebPage): (QWebPage::triggerAction): * Api/qwebpage.h: * Api/qwebpage_p.h: * Api/qwebsettings.cpp: * QtLauncher/main.cpp: (MainWindow::MainWindow): * WebCoreSupport/InspectorClientQt.cpp: (WebCore::InspectorClientWebPage::InspectorClientWebPage): (WebCore::InspectorClientWebPage::createWindow): (WebCore::InspectorClientQt::createPage): (WebCore::InspectorClientQt::showWindow): (WebCore::InspectorClientQt::closeWindow): (WebCore::InspectorClientQt::attachWindow): (WebCore::InspectorClientQt::detachWindow): (WebCore::InspectorClientQt::updateWindowTitle): * WebCoreSupport/InspectorClientQt.h: * docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp: Added. 2009-09-10 Laszlo Gombos <laszlo.1.gombos@nokia.com> Reviewed by Eric Seidel. [Qt] Fix comparison between signed and unsigned integer warnings https://bugs.webkit.org/show_bug.cgi?id=29162 No functional change. * Api/qwebelement.cpp: (QWebElement::findAll): * Api/qwebhistory.cpp: (QWebHistory::items): (QWebHistory::backItems): (QWebHistory::forwardItems): (QWebHistory::saveState): * Api/qwebplugindatabase.cpp: (QWebPluginDatabase::setSearchPaths): * WebCoreSupport/ChromeClientQt.cpp: (WebCore::ChromeClientQt::runOpenPanel): * WebCoreSupport/FrameLoaderClientQt.cpp: (WebCore::FrameLoaderClientQt::createPlugin): 2009-09-10 Simon Hausmann <hausmann@webkit.org> Rubber-stamped by Ariya Hidayat. Fix a bunch of qdoc warnings: Invalid references, non-standard wording, etc. * Api/qwebelement.cpp: * Api/qwebgraphicsitem.cpp: * Api/qwebsecurityorigin.cpp: 2009-09-10 Simon Hausmann <hausmann@webkit.org> Reviewed by Ariya Hidayat. Fix context menu event delivery with QWebGraphicsItem. Re-implement the correct context menu virtual function using a QGraphicsSceneContextMenuEvent and forward & handle it in QWebPage. * Api/qwebgraphicsitem.cpp: (QWebGraphicsItem::contextMenuEvent): * Api/qwebgraphicsitem.h: * Api/qwebpage.cpp: (QWebPagePrivate::contextMenuEvent): (QWebPage::event): * Api/qwebpage_p.h: 2009-09-10 Laszlo Gombos <laszlo.1.gombos@nokia.com> Unreviewed. Build fix for QtWebKit for Mac after r48219. qevent and qstyleoption are QtGui interfaces. * Api/qwebgraphicsitem.cpp: * Api/qwebgraphicsitem.h: 2009-09-09 Simon Hausmann <hausmann@webkit.org> Reviewed by Tor Arne Vestbø. Call the right base class function QGraphicsWidget::event() instead of skipping it and using QObject::event() instead. * Api/qwebgraphicsitem.cpp: (QWebGraphicsItem::event): 2009-09-09 Kenneth Rohde Christiansen <kenneth@webkit.org> Unreviewed. Fix comment at Tor Arne Vestbø's request. * Api/qwebgraphicsitem.cpp: (QWebGraphicsItem::sceneEvent): (QWebGraphicsItem::event): 2009-09-09 Kenneth Rohde Christiansen <kenneth@webkit.org> Reviewed by Tor Arne Vestbø. Implement some virtual event methods so that we can fix event-related bugs in Qt patch releases. * Api/qwebgraphicsitem.cpp: (QWebGraphicsItem::sceneEvent): (QWebGraphicsItem::event): * Api/qwebgraphicsitem.h: 2009-09-09 Kenneth Rohde Christiansen <kenneth@webkit.org>, Antonio Gomes <antonio.gomes@openbossa.org> Reviewed by Simon Hausmann. Add a new QGraphicsWidget based version of the "QWebView" under the name "QWebGraphicsItem". https://bugs.webkit.org/show_bug.cgi?id=28862 Includes an alternative Qt launcher using the QGraphicsView. * Api/headers.pri: * Api/qwebgraphicsitem.cpp: Added. * Api/qwebgraphicsitem.h: Added. * Api/qwebpage.h: * QGVLauncher/QGVLauncher.pro: Copied from WebKit/qt/QtLauncher/QtLauncher.pro. * QGVLauncher/main.cpp: Added. * WebCoreSupport/ChromeClientQt.cpp: (WebCore::ChromeClientQt::repaint): (WebCore::ChromeClientQt::scroll): 2009-09-08 Kenneth Rohde Christiansen <kenneth@webkit.org> Unreviewed build fix. Potential build fix for Qt 4.5 * Api/qwebpage.cpp: (QWebPagePrivate::mousePressEvent): 2009-09-08 Benjamin Poulain <benjamin.poulain@nokia.com> Reviewed by Simon Hausmann. https://bugs.webkit.org/show_bug.cgi?id=29007 Add a test for the signal QWebFrame::javaScriptWindowObjectCleared() * tests/qwebframe/tst_qwebframe.cpp: 2009-09-08 Laszlo Gombos <laszlo.1.gombos@nokia.com> Reviewed by Simon Hausmann. [Qt] Fix unused variable warnings https://bugs.webkit.org/show_bug.cgi?id=29018 * Api/qwebpage.cpp: (QWebPagePrivate::keyPressEvent): * WebCoreSupport/FrameLoaderClientQt.cpp: (WebCore::FrameLoaderClientQt::startDownload): (WebCore::FrameLoaderClientQt::createFrame): 2009-09-08 Laszlo Gombos <laszlo.1.gombos@nokia.com> Reviewed by Ariya Hidayat. [Qt] Use the declaration order in initializer lists https://bugs.webkit.org/show_bug.cgi?id=29017 * Api/qwebframe_p.h: 2009-09-08 Kenneth Rohde Christiansen <kenneth@webkit.org> Reviewed by Simon Hausmann. Add support for handling QGraphicsScene events. * Api/qwebpage.cpp: (QWebPagePrivate::mouseMoveEvent): (QWebPagePrivate::mousePressEvent): (QWebPagePrivate::mouseDoubleClickEvent): (QWebPagePrivate::mouseTripleClickEvent): (QWebPagePrivate::handleClipboard): (QWebPagePrivate::mouseReleaseEvent): (QWebPagePrivate::wheelEvent): (QWebPagePrivate::dragEnterEvent): (QWebPagePrivate::dragLeaveEvent): (QWebPagePrivate::dragMoveEvent): (QWebPagePrivate::dropEvent): (QWebPage::event): * Api/qwebpage_p.h: 2009-09-08 Kenneth Rohde Christiansen <kenneth@webkit.org> Reviewed by Simon Hausmann. [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack. https://bugs.webkit.org/show_bug.cgi?id=28865 Clean up the unserCursor hack to use the QCursor set as a property of the QWidget by WebCore::WidgetQt. Remove all code that are no longer necessary for getting cursor change events. Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07 * Api/qwebpage.cpp: * Api/qwebpage_p.h: * Api/qwebview.cpp: (QWebViewPrivate::QWebViewPrivate): (QWebView::event): 2009-09-08 Laszlo Gombos <laszlo.1.gombos@nokia.com> Reviewed by Simon Hausmann. [Qt] QtWebKit single API to enable persistency https://bugs.webkit.org/show_bug.cgi?id=28682 Disable LocalStorage, ApplicationCache, HTML5 offline storage by default. If persistency is enabled the default directory for LocalStorage and ApplicationCache is now based on QDesktopServices::DataLocation and not QDesktopServices::CacheLocation (as it is expected to keep this data around after a reboot). If persistency is enabled initialize HTML5 offline storage as well - this fixed offline Storage for QtLauncher. * Api/qwebpage.cpp: (QWebPagePrivate::QWebPagePrivate): * Api/qwebsettings.cpp: (QWebSettings::QWebSettings): (QWebSettings::enablePersistentStorage): * Api/qwebsettings.h: Add a new API called enablePersistentStorage * QtLauncher/main.cpp: Use the new enablePersistentStorage API (main): 2009-09-07 Jakub Wieczorek <faw217@gmail.com> Reviewed by Simon Hausmann. Speed up the QWebPluginInfo::supportsMimeType() function. https://bugs.webkit.org/show_bug.cgi?id=27651 Instead of going through the MIME types list constructed with mimeTypes() function, look up the internal mimeToDescriptions map. * Api/qwebplugindatabase.cpp: (QWebPluginInfo::supportsMimeType): 2009-09-07 Jakub Wieczorek <faw217@gmail.com> Reviewed by Simon Hausmann. Speed up the QWebPluginInfo::mimeTypes() function. https://bugs.webkit.org/show_bug.cgi?id=27651 Instead of constructing a list of MIME types every time it is called, do this only once. * Api/qwebplugindatabase.cpp: (QWebPluginInfo::mimeTypes): (QWebPluginInfo::operator=): * Api/qwebplugindatabase.h: * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp: (tst_QWebPluginDatabase::operatorassign_data): (tst_QWebPluginDatabase::operatorassign): 2009-09-07 Jakub Wieczorek <faw217@gmail.com> Reviewed by Simon Hausmann. Remove the private classes from QWebPluginDatabase. https://bugs.webkit.org/show_bug.cgi?id=27651 Instead, hold the PluginDatabase and PluginPackage objects as class members and take care of refcounting on our own instead of using RefPtr. This way we not only made the code cleaner but also got rid of redundant allocations when constructing null QWebPluginInfo objects. The private classes have been forward-declared and the d-pointers left to be on the safe side. * Api/qwebplugindatabase.cpp: (QWebPluginInfo::QWebPluginInfo): (QWebPluginInfo::~QWebPluginInfo): (QWebPluginInfo::name): (QWebPluginInfo::description): (QWebPluginInfo::mimeTypes): (QWebPluginInfo::path): (QWebPluginInfo::isNull): (QWebPluginInfo::setEnabled): (QWebPluginInfo::isEnabled): (QWebPluginInfo::operator==): (QWebPluginInfo::operator!=): (QWebPluginInfo::operator=): (QWebPluginDatabase::QWebPluginDatabase): (QWebPluginDatabase::~QWebPluginDatabase): (QWebPluginDatabase::plugins): (QWebPluginDatabase::searchPaths): (QWebPluginDatabase::setSearchPaths): (QWebPluginDatabase::addSearchPath): (QWebPluginDatabase::refresh): (QWebPluginDatabase::pluginForMimeType): (QWebPluginDatabase::setPreferredPluginForMimeType): * Api/qwebplugindatabase.h: * Api/qwebplugindatabase_p.h: Removed. 2009-09-05 Jakub Wieczorek <faw217@gmail.com> Reviewed by Eric Seidel. [Qt] r47424 broke binary compatibility https://bugs.webkit.org/show_bug.cgi?id=28996 Append the new DnsPrefetchEnabled attribute at the end of the enum. * Api/qwebsettings.h: 2009-09-04 Mark Mentovai <mark@chromium.org> Reviewed by Dave Hyatt. https://bugs.webkit.org/show_bug.cgi?id=28614 Account for scrollbar state changes that occur during layout. * Api/qwebframe.cpp: (QWebFrame::setScrollBarPolicy): Eliminate duplicated (and incorrect) scrollbar mode tracking between FrameView and ScrollView. 2009-09-04 Laszlo Gombos <laszlo.1.gombos@nokia.com> Reviewed by Eric Seidel. [Qt] Fix tst_QWebPage::database autotest failure https://bugs.webkit.org/show_bug.cgi?id=28961 Make sure that the test case enables the feature before the feature gets tested * tests/qwebpage/tst_qwebpage.cpp: (tst_QWebPage::database): 2009-09-04 Benjamin C Meyer <benjamin.meyer@torchmobile.com> Reviewed by Eric Seidel. Any QtWebKit application crashes on exit if the inspector is used during the session rather then exiting. If a QWebView has a QWebPage that is destroyed the QWebView does not update its pointer and will crash the next time it access the page pointers (such as in its destructor). InspectorClientView should not call deleteLater when the page is destroyed because it does not have a parent and is a top level widget. close() needs to be called so that QApplication can exit the application if quitOnLastWindowClosed is set and a InspectorClientView is the last window, otherwise the application will never exit. * Api/qwebview.cpp: (QWebViewPrivate::_q_pageDestroyed): (QWebView::setPage): * Api/qwebview.h: * WebCoreSupport/InspectorClientQt.cpp: (WebCore::InspectorClientView::InspectorClientView): 2009-09-03 Adam Barth <abarth@webkit.org> Reviewed by eric@webkit.org. https://bugs.webkit.org/show_bug.cgi?id=24696 Stub implementations of mixed content methods of FrameLoaderClient. * WebCoreSupport/FrameLoaderClientQt.cpp: (WebCore::FrameLoaderClientQt::didDisplayInsecureContent): (WebCore::FrameLoaderClientQt::didRunInsecureContent): * WebCoreSupport/FrameLoaderClientQt.h: 2009-09-03 Laszlo Gombos <laszlo.1.gombos@nokia.com> Reviewed by Eric Seidel. [Qt] Add a setting to turn SessionStorage on/off https://bugs.webkit.org/show_bug.cgi?id=28836 * Api/qwebsettings.cpp: (QWebSettingsPrivate::apply): (QWebSettings::QWebSettings): * Api/qwebsettings.h: * tests/qwebpage/tst_qwebpage.cpp: (testFlag): (tst_QWebPage::testOptionalJSObjects): 2009-09-02 Richard Moore <rich@kde.org> Reviewed by Tor Arne Vestbø. [Qt] Make sure we relayout the page after evaluating JS https://bugs.webkit.org/show_bug.cgi?id=28235 QtWebKit does not always seem to reflow the page when evaluating javascript. This patch changes the way evaluateJavaScript works to use the frameloader which ensures that this is done properly. * Api/qwebframe.cpp: (QWebFrame::evaluateJavaScript): * tests/qwebframe/tst_qwebframe.cpp: 2009-08-28 Gustavo Noronha Silva <gustavo.noronha@collabora.co.uk> Reviewed by Holger Freyther. https://bugs.webkit.org/show_bug.cgi?id=25889 [GTK] scrollbar policy for main frame is not implementable Add empty implementation for new ChromeClient method. * WebCoreSupport/ChromeClientQt.h: (WebCore::ChromeClientQt::scrollbarsModeDidChange): 2009-08-27 Jedrzej Nowacki <jedrzej.nowacki@nokia.com> Reviewed by Ariya Hidayat. QWebHistory::clear() modifications. Clear() method was changed. If QWebHistory is empty (there is no elements even current) clear() do nothing. If there at least one element clear() will delete everything apart of current. New autotests in QWebHistory New autotests were added to QWebHistory. They should check some crashes in save and restore state process and clear() method and general behavior on where QWebHistory::count() == 0 or QWebHistory::count() == 1 Bugzilla: https://bugs.webkit.org/show_bug.cgi?id=28711 * Api/qwebhistory.cpp: (QWebHistory::clear): * tests/qwebhistory/tst_qwebhistory.cpp: (tst_QWebHistory::back): (tst_QWebHistory::forward): (tst_QWebHistory::saveAndRestore_crash_1): (tst_QWebHistory::saveAndRestore_crash_2): (tst_QWebHistory::saveAndRestore_crash_3): (tst_QWebHistory::clear): 2009-08-27 Jedrzej Nowacki <jedrzej.nowacki@nokia.com> Reviewed by Ariya Hidayat. [Qt] Cleanup, old and commented part of source code was removed. Fix some formatting problems. https://bugs.webkit.org/show_bug.cgi?id=28712 * Api/qwebhistory_p.h: (QWebHistoryPrivate::QWebHistoryPrivate): 2009-08-26 Adam Barth <abarth@webkit.org> Reviewed by Oliver Hunt. Don't let local files access web URLs https://bugs.webkit.org/show_bug.cgi?id=28480 * Api/qwebsettings.cpp: (QWebSettings::QWebSettings): 2009-08-25 Antonio Gomes <antonio.gomes@openbossa.org> Reviewed by Ariya Hidayat. Bug 28708 - Make possible to better use ResourceError in FrameLoaderClientQt class. * Api/qwebframe.cpp: (QWebFrame::requestedUrl): * WebCoreSupport/FrameLoaderClientQt.cpp: (WebCore::FrameLoaderClientQt::FrameLoaderClientQt): (WebCore::FrameLoaderClientQt::dispatchDidFinishLoad): (WebCore::FrameLoaderClientQt::postProgressFinishedNotification): (WebCore::FrameLoaderClientQt::dispatchDidFailProvisionalLoad): (WebCore::FrameLoaderClientQt::dispatchDidFailLoad): * WebCoreSupport/FrameLoaderClientQt.h: 2009-08-22 Adam Barth <abarth@webkit.org> Revert 47684. We're going to do this later once clients have had a chance to opt into the setting they like. * Api/qwebsettings.cpp: (QWebSettings::QWebSettings): 2009-08-22 Adam Barth <abarth@webkit.org> Reviewed by Eric Seidel. Don't let local files access web URLs https://bugs.webkit.org/show_bug.cgi?id=28480 * Api/qwebsettings.cpp: (QWebSettings::QWebSettings): 2009-08-19 Aaron Boodman <aa@chromium.org> Speculative build break fix for qt. * Api/qwebsecurityorigin.cpp: (QWebSecurityOrigin::whiteListAccessFromOrigin): * Api/qwebsecurityorigin.h: 2009-08-19 Aaron Boodman <aa@chromium.org> Reviewed by David Levin. https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to specify a more granular policy for cross-origin XHR access. * Api/qwebsecurityorigin.cpp: Add API to manipulate origin access whitelists. (QWebSecurityOrigin::whiteListAccessFromOrigin): Ditto. (QWebSecurityOrigin::resetOriginAccessWhiteLists): Ditto. * Api/qwebsecurityorigin.h: Ditto. 2009-08-18 Markus Goetz <Markus.Goetz@nokia.com> Reviwed by Ariya Hidayat. [Qt] For prefecthDNS, the pre-fetching has to be enabled in the WebSettings. * Api/qwebsettings.cpp: (QWebSettings::QWebSettings): * Api/qwebsettings.h: 2009-08-17 Darin Adler <darin@apple.com> Try to fix Qt build again. * WebCoreSupport/EditorClientQt.cpp: Move "using namespace". 2009-08-17 Darin Adler <darin@apple.com> Try to fix Qt build. * WebCoreSupport/EditorClientQt.cpp: (WebCore::EditorClientQt::shouldShowDeleteInterface): Use getAttribute(classAttr) instead of className() function. 2009-08-14 Yongjun Zhang <yongjun.zhang@nokia.com> Reviewed by Simon Hausmann. RVCT elftran fails to resolve QPainter::staticMetaObject coming with QWebView::RenderHints property. This is a temporary fix and will be revereted when the right symbols exported from Qt lib in S60. https://bugs.webkit.org/show_bug.cgi?id=28181 * Api/qwebview.h: 2009-08-14 Laszlo Gombos <laszlo.1.gombos@nokia.com> Reviewed by Simon Hausmann. [Qt] Public API to configure the storage path for HTML5 localStorage https://bugs.webkit.org/show_bug.cgi?id=28036 Disables LocalStorage for QtWebKit by default by setting QWebSettings::LocalStorageEnabled to false. Sets up a default for the LocalStorage path so that clients would only need to enable the LocalStorageEnabled setting to turn on LocalStoragre support. Turn on LocalStorage support for QtLauncher and the relevant test since LocalStorage is now disabled by default for QtWebkit. * Api/qwebpage.cpp: (defaultCachePath): (initializeApplicationCachePathIfNecessary): (QWebPagePrivate::QWebPagePrivate): * Api/qwebsettings.cpp: (QWebSettingsPrivate::apply): (QWebSettings::QWebSettings): (QWebSettings::setLocalStoragePath): (QWebSettings::localStoragePath): * Api/qwebsettings.h: * QtLauncher/main.cpp: (main): * tests/qwebpage/tst_qwebpage.cpp: (tst_QWebPage::multiplePageGroupsAndLocalStorage): 2009-08-14 Yael Aharon <yael.aharon@nokia.com> Reviewed by Simon Hausmann. [Qt] Allow applications to register their own local URL scheme. https://bugs.webkit.org/show_bug.cgi?id=28240 * Api/qwebsecurityorigin.cpp: (QWebSecurityOrigin::addLocalScheme): (QWebSecurityOrigin::removeLocalScheme): (QWebSecurityOrigin::localSchemes): * Api/qwebsecurityorigin.h: * tests/qwebpage/tst_qwebpage.cpp: (tst_QWebPage::localURLSchemes): 2009-08-13 Mark Rowe <mrowe@apple.com> Try and fix the Qt build. * Api/qwebelement.cpp: 2009-08-13 Kavindra Devi Palaraja <kavindra.palaraja@nokia.com> Reviewed by Simon Hausmann. Doc - Some cleanup on the documentation of QWebElement * Api/qwebelement.cpp: 2009-08-13 Norbert Leser <norbert.leser@nokia.com> Reviewed by Simon Hausmann. Symbian target components (library and executable files) require Unique Identifiers (i.e., UID3). These identifiers are defined in the respective project files, conditionally for "symbian" platform. * QtLauncher/QtLauncher.pro: * tests/qwebelement/qwebelement.pro: * tests/qwebframe/qwebframe.pro: * tests/qwebhistory/qwebhistory.pro: * tests/qwebhistoryinterface/qwebhistoryinterface.pro: * tests/qwebpage/qwebpage.pro: * tests/qwebview/qwebview.pro: 2009-08-12 George Wright <george.wright@torchmobile.com> Reviewed by Adam Treat. Initialise zoom levels independent of whether a URL is valid or not to fix https://bugs.webkit.org/show_bug.cgi?id=28162 * QtLauncher/main.cpp: (MainWindow::MainWindow): 2009-08-12 Joerg Bornemann <joerg.bornemann@trolltech.com> Reviewed by Simon Hausmann. QtWebKit compile fix for Windows CE There's no getenv on Windows CE, use qgetenv instead. * Api/qwebpage.cpp: (qt_drt_overwritePluginDirectories): 2009-08-10 Kavindra Palaraja <kavindra.palaraja@nokia.com> Reviewed by Simon Hausmann. Various fixes and improvements to the QWebPluginInfo, QWebPluginDatabase and QWebSettings documentation. * Api/qwebplugindatabase.cpp: * Api/qwebsettings.cpp: 2009-08-08 Volker Hilsheimer <volker.hilsheimer@nokia.com> Reviewed by Simon Hausmann. Doc: there is no group of explicitly shared classes, only one class uses this. Explain the implications in the QWebHistoryItem documentation, and get rid of the "group". * Api/qwebhistory.cpp: 2009-08-05 Csaba Osztrogonac <oszi@inf.u-szeged.hu> Reviewed by Simon Hausmann. [Qt] Fix build error caused by http://trac.webkit.org/changeset/46763 * Api/qwebpluginfactory.h: Export macro added. 2009-08-04 Antonio Gomes <antonio.gomes@openbossa.org> Reviewed by Simon Hausmann. [Qt] QWebFrame::requestedUrl method can mis-behave in case of unhandled sslErrors. https://bugs.webkit.org/show_bug.cgi?id=27804 * Api/qwebframe.cpp: (QWebFrame::requestedUrl): * tests/qwebframe/tst_qwebframe.cpp: 2009-08-04 Simon Hausmann <simon.hausmann@nokia.com> Reviewed by Tor Arne Vestbø. Rename QWebPlugin to QWebPluginInfo, as discussed on IRC. * Api/qwebplugindatabase.cpp: (QWebPluginInfoPrivate::QWebPluginInfoPrivate): (QWebPluginInfo::QWebPluginInfo): (QWebPluginInfo::~QWebPluginInfo): (QWebPluginInfo::name): (QWebPluginInfo::description): (QWebPluginInfo::mimeTypes): (QWebPluginInfo::supportsMimeType): (QWebPluginInfo::path): (QWebPluginInfo::isNull): (QWebPluginInfo::setEnabled): (QWebPluginInfo::isEnabled): (QWebPluginInfo::operator==): (QWebPluginInfo::operator!=): (QWebPluginInfo::operator=): (QWebPluginDatabase::plugins): (QWebPluginDatabase::pluginForMimeType): (QWebPluginDatabase::setPreferredPluginForMimeType): * Api/qwebplugindatabase.h: * Api/qwebplugindatabase_p.h: * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp: (tst_QWebPluginDatabase::installedPlugins): (tst_QWebPluginDatabase::searchPaths): (tst_QWebPluginDatabase::null_data): (tst_QWebPluginDatabase::null): (tst_QWebPluginDatabase::pluginForMimeType): (tst_QWebPluginDatabase::enabled): (tst_QWebPluginDatabase::operatorequal_data): (tst_QWebPluginDatabase::operatorequal): (tst_QWebPluginDatabase::preferredPlugin): 2009-08-04 Simon Hausmann <simon.hausmann@nokia.com> Reviewed by Adam Treat. Replace QWebPlugin::MimeType with a typedef to QWebPluginFactory::MimeType. * Api/qwebplugindatabase.cpp: * Api/qwebplugindatabase.h: * Api/qwebpluginfactory.cpp: (QWebPluginFactory::MimeType::operator==): * Api/qwebpluginfactory.h: 2009-08-04 Jakub Wieczorek <faw217@gmail.com> Reviewed by Simon Hausmann. Add QWebPluginDatabase API to the Qt API. https://bugs.webkit.org/show_bug.cgi?id=27651 * Api/headers.pri: * Api/qwebplugindatabase.cpp: Added. (QWebPluginPrivate::QWebPluginPrivate): (QWebPluginDatabasePrivate::QWebPluginDatabasePrivate): (QWebPlugin::MimeType::operator==): (QWebPlugin::QWebPlugin): (QWebPlugin::~QWebPlugin): (QWebPlugin::name): (QWebPlugin::description): (QWebPlugin::mimeTypes): (QWebPlugin::supportsMimeType): (QWebPlugin::path): (QWebPlugin::isNull): (QWebPlugin::setEnabled): (QWebPlugin::isEnabled): (QWebPlugin::operator==): (QWebPlugin::operator!=): (QWebPlugin::operator=): (QWebPluginDatabase::QWebPluginDatabase): (QWebPluginDatabase::~QWebPluginDatabase): (QWebPluginDatabase::plugins): (QWebPluginDatabase::defaultSearchPaths): (QWebPluginDatabase::searchPaths): (QWebPluginDatabase::setSearchPaths): (QWebPluginDatabase::addSearchPath): (QWebPluginDatabase::refresh): (QWebPluginDatabase::pluginForMimeType): (QWebPluginDatabase::setPreferredPluginForMimeType): * Api/qwebplugindatabase.h: Added. * Api/qwebplugindatabase_p.h: Added. * Api/qwebsettings.cpp: (QWebSettings::pluginDatabase): * Api/qwebsettings.h: * tests/qwebplugindatabase/qwebplugindatabase.pro: Added. * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp: Added. (tst_QWebPluginDatabase::installedPlugins): (tst_QWebPluginDatabase::searchPaths): (tst_QWebPluginDatabase::null_data): (tst_QWebPluginDatabase::null): (tst_QWebPluginDatabase::pluginForMimeType): (tst_QWebPluginDatabase::enabled): (tst_QWebPluginDatabase::operatorequal_data): (tst_QWebPluginDatabase::operatorequal): (tst_QWebPluginDatabase::preferredPlugin): * tests/tests.pro: 2009-08-03 Balazs Kelemen <kelemen.balazs.3@stud.u-szeged.hu> Reviewed by Simon Hausmann. Do memory cleanup when running robotized QtLauncher in debug as well. * QtLauncher/main.cpp: (launcherMain): (main): 2009-07-30 Laszlo Gombos <laszlo.1.gombos@nokia.com> Reviewed by Tor Arne Vestbø. [Qt] Initialize HTML5 Application Cache for QtWebKit to a sensible default https://bugs.webkit.org/show_bug.cgi?id=27866 * Api/qwebpage.cpp: (initializeApplicationCachePathIfNecessary): (QWebPagePrivate::QWebPagePrivate): 2009-07-31 Jakob Petsovits <jakob.petsovits@torchmobile.com> Reviewed by Adam Treat. Build QtWebKit without benchmark tests for Qt < 4.5. https://bugs.webkit.org/show_bug.cgi?id=27886 The QBENCHMARK macro is only available from 4.5 on, so builds for Qt < 4.5 shouldn't try to build those. * tests/tests.pro: 2009-07-31 Kenneth Rohde Christiansen <kenneth@webkit.org> Reviewed by Adam Treat. Fix warning by migrating use of QString.sprintf(...) to QString.arg().arg()... * WebCoreSupport/EditorClientQt.cpp: (dumpRange): 2009-07-31 Kenneth Rohde Christiansen <kenneth@webkit.org> Reviewed by Tor Arne Vestbø. Expose the Offline Web Application Cache in the Qt API. * Api/qwebsettings.cpp: (QWebSettings::QWebSettings): (QWebSettings::setOfflineWebApplicationCachePath): (QWebSettings::offlineWebApplicationCachePath): (QWebSettings::setOfflineWebApplicationCacheQuota): (QWebSettings::offlineWebApplicationCacheQuota): * Api/qwebsettings.h: 2009-07-30 Kenneth Rohde Christiansen <kenneth@webkit.org> Reviewed by Adam Treat. Add missing Q_OBJECT to class inheriting from QObject. * tests/qwebframe/tst_qwebframe.cpp: 2009-07-30 Kenneth Rohde Christiansen <kenneth@webkit.org> Reviewed by Adam Treat. Fix indentation. * tests/qwebframe/tst_qwebframe.cpp: 2009-07-30 Volker Hilsheimer <volker.hilsheimer@nokia.com> Reviewed by Simon Hausmann. Fix documentation links to examples. * Api/qwebview.cpp: 2009-07-30 Balazs Kelemen <kelemen.balazs.3@stud.u-szeged.hu> Reviewed by Simon Hausmann. Allocate MainWindow on heap in robotized QtLauncher as well. * QtLauncher/main.cpp: (main): 2009-07-29 Kevin McCullough <kmccullough@apple.com> Reviewed by Darin Adler. Added foundation work to allow a testing infrastructure for the Web Inspector. * WebCoreSupport/InspectorClientQt.cpp: (WebCore::InspectorClientQt::inspectorWindowObjectCleared): * WebCoreSupport/InspectorClientQt.h: 2009-07-29 Zoltan Herczeg <zherczeg@inf.u-szeged.hu> Reviewed by Simon Hausmann. [Qt] In debug mode, this fix frees cached resources and other unreferenced objects (by calling the garbage collector) to remove the LEAK messages. https://bugs.webkit.org/show_bug.cgi?id=27767 * Api/qwebframe.cpp: (qt_drt_cache_clear): * QtLauncher/main.cpp: (main): 2009-07-28 Kenneth Rohde Christiansen <kenneth@webkit.org> Fix the Qt build by adapting to the changes of ScriptObject. * Api/qwebelement.cpp: (setupScriptObject): 2009-07-28 Robert Hogan <robert@roberthogan.net> Reviewed by Simon Hausmann. Add WebKit version API to Qt. Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig at compile time and make it available to Qt applications through qWebKitVersion(). Also amend the User Agent string to place the Safari clause outside the final bracket and to the end of the UA string. https://bugs.webkit.org/show_bug.cgi?id=27158 Minor build tweak by Simon Hausmann (adding export macros to new functions). * Api/headers.pri: * Api/qwebkitversion.cpp: Added. (webKitVersion): (webKitMajorVersion): (webKitMinorVersion): * Api/qwebkitversion.h: Added. * Api/qwebpage.cpp: (QWebPage::userAgentForUrl): * tests/qwebview/tst_qwebview.cpp: (tst_QWebView::getWebKitVersion): http://qt.nokia.com/developer/task-tracker/index_html?id=238391&method=entry http://qt.nokia.com/developer/task-tracker/index_html?id=219344&method=entry http://qt.nokia.com/developer/task-tracker/index_html?id=241144&method=entry
author: Jocelyn Turcotte <jocelyn.turcotte@nokia.com> 2009-09-18 08:35:59 (GMT)
committer: Jocelyn Turcotte <jocelyn.turcotte@nokia.com> 2009-09-18 08:38:07 (GMT)
commit: ef310719ef42cd09e2542fce96c529b5657bf167 (patch)
tree: c691bab10518e479ce40d4cac6c79daa312fce87 /src/3rdparty/webkit/WebCore/bindings/js
parent: 5b828316abb0ad1a33cdc11ebac0999d9b79576a (diff)
download: Qt-ef310719ef42cd09e2542fce96c529b5657bf167.zip
Qt-ef310719ef42cd09e2542fce96c529b5657bf167.tar.gz
Qt-ef310719ef42cd09e2542fce96c529b5657bf167.tar.bz2
139 files changed, 4368 insertions, 802 deletions
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 3146413..475b374 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -43,18 +44,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSAbstractWorker::mark()
+void JSAbstractWorker::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
-    markIfNotNull(m_impl->onerror());
+    markIfNotNull(markStack, m_impl->onerror());
 
     typedef AbstractWorker::EventListenersMap EventListenersMap;
     typedef AbstractWorker::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -63,10 +64,12 @@ JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -75,10 +78,12 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index abd5ad5..e217023 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -48,7 +48,8 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     Element* ownerElement = imp->ownerElement();
     if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
         if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(deprecatedParseURL(attrValue))) {
-            if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
+            Document* contentDocument = static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument();
+            if (contentDocument && !checkNodeSecurity(exec, contentDocument))
                 return;
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
index 87a3880..174cc11 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSHTMLAudioElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleListCustom.cpp
new file mode 100644
index 0000000..be3a9a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleListCustom.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCSSRuleList.h"
+
+#include "CSSRuleList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCSSRuleList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSRuleList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 280ec93..4a137d3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,8 +27,8 @@
 #include "JSCSSStyleDeclarationCustom.h"
 
 #include "AtomicString.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
-#include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
 #include "PlatformString.h"
 #include <runtime/StringObjectThatMasqueradesAsUndefined.h>
@@ -40,6 +40,21 @@ using namespace WTF;
 
 namespace WebCore {
 
+void JSCSSStyleDeclaration::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSStyleDeclaration* declaration = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    if (declaration->isMutableStyleDeclaration()) {
+        CSSMutableStyleDeclaration* mutableDeclaration = static_cast<CSSMutableStyleDeclaration*>(declaration);
+        CSSMutableStyleDeclaration::const_iterator end = mutableDeclaration->end();
+        for (CSSMutableStyleDeclaration::const_iterator it = mutableDeclaration->begin(); it != end; ++it)
+            markDOMObjectWrapper(markStack, globalData, it->value());
+    }
+}
+
 // Check for a CSS prefix.
 // Passed prefix is all lowercase.
 // First character of the prefix within the property name may be upper or lowercase.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
new file mode 100644
index 0000000..93d53ca
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasArrayBufferConstructor.h"
+
+#include "Document.h"
+#include "CanvasArrayBuffer.h"
+#include "JSCanvasArrayBuffer.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
+
+JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
+
+    unsigned int size = 0;
+    if (args.size() == 1) {
+        size = (unsigned int)args.at(0).toInt32(exec);
+        if (isnan(size))
+            size = 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
+}
+
+JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasArrayBuffer;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
new file mode 100644
index 0000000..44c9000
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasArrayBufferConstructor_h
+#define JSCanvasArrayBufferConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+#include "JSCanvasArrayBuffer.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+    class CanvasArray;
+
+    // Template function used by CanvasXXXArrayConstructors
+    template<class C, typename T>
+    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    {
+        // There are 3 constructors:
+        //
+        //  1) (in int size)
+        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  3) (in sequence<T>) - This ends up being a JS "array-like" object
+        //
+        RefPtr<C> arrayObject;
+        
+        if (args.size() < 1)
+            return 0;
+        
+        if (args.at(0).isObject()) {
+            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
+            if (buffer) {
+                int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
+                unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
+                return C::create(buffer, offset, length);
+            }
+            
+            JSC::JSObject* array = asObject(args.at(0));
+            int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+            void* tempValues;
+            if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues)) {
+                throwError(exec, JSC::GeneralError);
+                return 0;
+            }
+            
+            OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
+            for (int i = 0; i < length; ++i) {
+                JSC::JSValue v = array->get(exec, i);
+                if (exec->hadException())
+                    return 0;
+                values.get()[i] = static_cast<T>(v.toNumber(exec));
+            }
+            
+            return C::create(values.get(), length);
+        }
+        
+        unsigned size = static_cast<unsigned>(args.at(0).toInt32(exec));
+        return C::create(size);
+    }
+
+    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasArrayBufferConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
new file mode 100644
index 0000000..4aa1547
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSCanvasArray.h"
+
+#include "CanvasArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
new file mode 100644
index 0000000..ec1d66d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
+    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
new file mode 100644
index 0000000..4d5dc11
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasByteArrayConstructor_h
+#define JSCanvasByteArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
new file mode 100644
index 0000000..04697ce
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArray.h"
+
+#include "CanvasByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
new file mode 100644
index 0000000..15e39c2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasFloatArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasFloatArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
+    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasFloatArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
new file mode 100644
index 0000000..efea250
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasFloatArrayConstructor_h
+#define JSCanvasFloatArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasFloatArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
new file mode 100644
index 0000000..20cd805c0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArray.h"
+
+#include "CanvasFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
new file mode 100644
index 0000000..6d57912
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
+    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
new file mode 100644
index 0000000..5e19652
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasIntArrayConstructor_h
+#define JSCanvasIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
new file mode 100644
index 0000000..8442b87
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArray.h"
+
+#include "CanvasIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
new file mode 100644
index 0000000..be10ac0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasNumberArray.h"
+
+#include "CanvasNumberArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasNumberArray::getByIndex(JSC::ExecState* exec, unsigned int index)
+{
+    JSC::JSValue result = jsNumber(exec, impl()->item(index));
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 398a679..bb3500b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -67,27 +67,31 @@ static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
 
 JSValue JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->strokeStyle());        
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->strokeStyle());        
 }
 
 void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue value)
 {
-    impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setStrokeStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->fillStyle());
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->fillStyle());
 }
 
 void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue value)
 {
-    impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setFillStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
 {
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -124,7 +128,7 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -162,7 +166,7 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
 
 JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     if (args.size() <= 4)
         context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
@@ -176,7 +180,7 @@ JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& a
 
 JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // DrawImage has three variants:
     //     drawImage(img, dx, dy)
@@ -264,7 +268,7 @@ JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -284,7 +288,7 @@ JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const Arg
 
 JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     switch (args.size()) {
         case 3:
@@ -330,7 +334,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -362,7 +366,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
     // putImageData has two variants
     // putImageData(ImageData, x, y)
     // putImageData(ImageData, x, y, dirtyX, dirtyY, dirtyWidth, dirtyHeight)
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     ExceptionCode ec = 0;
     if (args.size() >= 7)
@@ -377,7 +381,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
@@ -395,7 +399,7 @@ JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& arg
 
 JSValue JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
new file mode 100644
index 0000000..3938ba1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
@@ -0,0 +1,443 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasRenderingContext3D.h"
+
+#include "CanvasRenderingContext3D.h"
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "JSCanvasFloatArray.h"
+#include "JSCanvasIntArray.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSWebKitCSSMatrix.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
+        return jsUndefined();
+    }
+
+    CanvasArray* array = toCanvasArray(args.at(1));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
+    return jsUndefined();
+}
+
+JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    
+    CanvasArray* array = toCanvasArray(args.at(2));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
+    return jsUndefined();
+}
+
+// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    if (args.size() > 5) {
+        // This must be the bare array case.
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+            
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        CanvasArray* array = toCanvasArray(args.at(8));
+        if (exec->hadException())    
+            return jsUndefined();
+            
+        if (!array)
+            return throwError(exec, TypeError);
+        
+        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
+        // depending on the passed type parameter.
+        
+        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
+        return jsUndefined();
+    }
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(2);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 7 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned level = args.at(1).toInt32(exec);
+    unsigned xoff = args.at(2).toInt32(exec);
+    unsigned yoff = args.at(3).toInt32(exec);
+    unsigned width = args.at(4).toInt32(exec);
+    unsigned height = args.at(5).toInt32(exec);
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(6);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    ExceptionCode ec = 0;
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+template<typename T>
+void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
+{
+    array = 0;
+    
+    if (!value.isObject())
+        return;
+        
+    JSC::JSObject* object = asObject(value);
+    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    void* tempValues;
+    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
+        return;
+    
+    T* values = static_cast<T*>(tempValues);
+    for (int i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        values[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    array = values;
+    size = length;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
+            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
+            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
+            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
+            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1fv(location, array, size); break;
+        case f_uniform2v: context->uniform2fv(location, array, size); break;
+        case f_uniform3v: context->uniform3fv(location, array, size); break;
+        case f_uniform4v: context->uniform4fv(location, array, size); break;
+        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
+        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
+        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
+        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
+            default: break;
+        }
+        return jsUndefined();
+    }
+    
+    int* array;
+    int size;
+    toArray<int>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1iv(location, array, size); break;
+        case f_uniform2v: context->uniform2iv(location, array, size); break;
+        case f_uniform3v: context->uniform3iv(location, array, size); break;
+        case f_uniform4v: context->uniform4iv(location, array, size); break;
+        default: break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(2), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
+        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
+        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
+    }
+    return jsUndefined();
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
new file mode 100644
index 0000000..0cd2aa3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCanvasRenderingContext.h"
+
+#include "CanvasRenderingContext2D.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "CanvasRenderingContext3D.h"
+#include "JSCanvasRenderingContext3D.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasRenderingContext* object)
+{
+    if (!object)
+        return jsUndefined();
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
new file mode 100644
index 0000000..a885b7b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasShortArray.h"
+#include "JSCanvasArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
+    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
new file mode 100644
index 0000000..df21825
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasShortArrayConstructor_h
+#define JSCanvasShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
new file mode 100644
index 0000000..21af0a6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArray.h"
+
+#include "CanvasShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
new file mode 100644
index 0000000..5d0800e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
new file mode 100644
index 0000000..9cfb721
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedByteArrayConstructor_h
+#define JSCanvasUnsignedByteArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
new file mode 100644
index 0000000..f2b0c74
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArray.h"
+
+#include "CanvasUnsignedByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
new file mode 100644
index 0000000..5f145a7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000..6016159
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedIntArrayConstructor_h
+#define JSCanvasUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000..95a80a7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArray.h"
+
+#include "CanvasUnsignedIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
new file mode 100644
index 0000000..9735693
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedShortArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
new file mode 100644
index 0000000..23c197f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedShortArrayConstructor_h
+#define JSCanvasUnsignedShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
new file mode 100644
index 0000000..290cd4b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArray.h"
+
+#include "CanvasUnsignedShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
index 73946c8..78dca49 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -59,7 +59,7 @@ JSValue JSClipboard::types(ExecState* exec) const
     MarkedArgumentBuffer list;
     HashSet<String>::const_iterator end = types.end();
     for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
-        list.append(jsString(exec, it->operator UString()));
+        list.append(jsString(exec, UString(*it)));
     return constructArray(exec, list);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index e28fd8f..7074423 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -35,23 +35,18 @@ namespace WebCore {
 
 using namespace JSC;
 
-JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, Frame* frame)
+JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
 
-void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raisedException)
+void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
+    ASSERT(m_globalObject);
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
     
     JSC::JSLock lock(SilenceAssertionsOnly);
     
@@ -72,14 +67,12 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raise
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), geoposition));
 
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
-    
-    if (exec->hadException()) {
+    m_globalObject->globalData()->timeoutChecker.stop();
+
+    if (exec->hadException())
         reportCurrentException(exec);
-        raisedException = true;
-    }
     
     Document::updateStyleForAllDocuments();
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
index 6c0d306..15a166a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
@@ -27,30 +27,28 @@
 #define JSCustomPositionCallback_h
 
 #include "PositionCallback.h"
-#include <runtime/JSObject.h>
+#include "JSDOMGlobalObject.h"
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class Geoposition;
 
 class JSCustomPositionCallback : public PositionCallback {
 public:
-    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionCallback(callback, globalObject));
+    }
     
-    virtual void handleEvent(Geoposition*, bool& raisedException);
-
 private:
-    JSCustomPositionCallback(JSC::JSObject* callback, Frame*);
+    JSCustomPositionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
+
+    virtual void handleEvent(Geoposition*);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index dbe46e2..9109cd1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -35,23 +35,18 @@ namespace WebCore {
     
 using namespace JSC;
 
-JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, Frame* frame)
+JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
 
 void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
+    ASSERT(m_globalObject);
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
     
     JSC::JSLock lock(SilenceAssertionsOnly);
     
@@ -72,13 +67,13 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), positionError));
     
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
     
     if (exec->hadException())
         reportCurrentException(exec);
-    
+
     Document::updateStyleForAllDocuments();
 }
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
index 9f143a2..d97e967 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
@@ -27,30 +27,27 @@
 #define JSCustomPositionErrorCallback_h
 
 #include "PositionErrorCallback.h"
-#include <runtime/JSObject.h>
+#include "JSDOMGlobalObject.h"
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
     
-class Frame;
 class PositionError;
 
 class JSCustomPositionErrorCallback : public PositionErrorCallback {
 public:
-    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionErrorCallback(callback, globalObject));
+    }
     
-    virtual void handleEvent(PositionError*);
-
 private:
-    JSCustomPositionErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomPositionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
+    virtual void handleEvent(PositionError*);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index a2b5c83..cdeda8f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -28,6 +28,7 @@
 
 #include "config.h"
 #include "JSCustomSQLStatementCallback.h"
+
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
@@ -40,23 +41,18 @@ namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, Frame* frame)
+JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
     
 void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
+    ASSERT(m_globalObject);
         
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
         
     JSC::JSLock lock(SilenceAssertionsOnly);
 
@@ -78,9 +74,9 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), resultSet));
         
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException()) {
         reportCurrentException(exec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index c380670..e6600c5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -31,32 +31,29 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSDOMGlobalObject.h"
 #include "SQLStatementCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class SQLResultSet;
 
 class JSCustomSQLStatementCallback : public SQLStatementCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementCallback(callback, globalObject));
+    }
 
     virtual void handleEvent(SQLTransaction*, SQLResultSet*, bool& raisedException);
 
 private:
-    JSCustomSQLStatementCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index c7c467f..ea47c64 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -41,23 +41,18 @@ namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, Frame* frame)
+JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
     
 bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
+    ASSERT(m_globalObject);
         
-    if (!m_frame->script()->isEnabled())
-        return true;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
         
     JSC::JSLock lock(SilenceAssertionsOnly);
         
@@ -82,13 +77,13 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
         
     JSValue result;
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
     else
         result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
-        
+    m_globalObject->globalData()->timeoutChecker.stop();
+
     if (exec->hadException()) {
         reportCurrentException(exec);
             
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index e563393..e03ac35 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -31,32 +31,29 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSDOMGlobalObject.h"
 #include "SQLStatementErrorCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
     
-class Frame;
 class SQLError;
     
 class JSCustomSQLStatementErrorCallback : public SQLStatementErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementErrorCallback(callback, globalObject));
+    }
         
     virtual bool handleEvent(SQLTransaction*, SQLError*);
 
 private:
-    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
     
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index ca7f069..1886345 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -32,9 +32,10 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSDOMGlobalObject.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
 #include <wtf/MainThread.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -47,25 +48,28 @@ using namespace JSC;
 static WTF::RefCountedLeakCounter counter("JSCustomSQLTransactionCallback");
 #endif
 
-// We have to clean up the data on the main thread for two reasons:
-//
-//     1) Can't deref a Frame on a non-main thread.
-//     2) Unprotecting the JSObject on a non-main thread would register that thread
-//        for JavaScript garbage collection, which could unnecessarily slow things down.
+// We have to clean up the data on the main thread because unprotecting the 
+// JSObject on a non-main thread would register that thread for JavaScript
+// garbage collection, which could unnecessarily slow things down.
 
 class JSCustomSQLTransactionCallback::Data {
 public:
-    Data(JSObject* callback, Frame* frame) : m_callback(callback), m_frame(frame) { }
+    Data(JSObject* callback, JSDOMGlobalObject* globalObject)
+        : m_callback(callback)
+        , m_globalObject(globalObject)
+    {
+    }
+
     JSObject* callback() { return m_callback; }
-    Frame* frame() { return m_frame.get(); }
+    JSDOMGlobalObject* globalObject() { return m_globalObject.get(); }
 
 private:
     ProtectedPtr<JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
 
-JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, Frame* frame)
-    : m_data(new Data(callback, frame))
+JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new Data(callback, globalObject))
 {
 #ifndef NDEBUG
     counter.increment();
@@ -90,13 +94,9 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
 {
     ASSERT(m_data);
     ASSERT(m_data->callback());
-    ASSERT(m_data->frame());
-
-    if (!m_data->frame()->script()->isEnabled())
-        return;
+    ASSERT(m_data->globalObject());
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_data->frame()->script()->globalObject();
+    JSDOMGlobalObject* globalObject = m_data->globalObject();
     ExecState* exec = globalObject->globalExec();
         
     JSC::JSLock lock(SilenceAssertionsOnly);
@@ -120,12 +120,12 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
 
-    globalObject->globalData()->timeoutChecker->start();
+    globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
     else
         call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->globalData()->timeoutChecker->stop();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException()) {
         reportCurrentException(exec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index 22c367c..f7f78f2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -32,7 +32,6 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionCallback.h"
-
 #include <wtf/PassRefPtr.h>
 
 namespace JSC {
@@ -42,17 +41,21 @@ namespace JSC {
 namespace WebCore {
 
 class Frame;
+class JSDOMGlobalObject;
 
 class JSCustomSQLTransactionCallback : public SQLTransactionCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionCallback(callback, globalObject));
+    }
 
     virtual ~JSCustomSQLTransactionCallback();
     
     virtual void handleEvent(SQLTransaction*, bool& raisedException);
 
 private:
-    JSCustomSQLTransactionCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLTransactionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
     static void deleteData(void*);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index 1c6de7f..b2f8280 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -40,23 +40,18 @@ namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, Frame* frame)
+JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
     
 void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
+    ASSERT(m_globalObject);
 
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
 
     JSC::JSLock lock(SilenceAssertionsOnly);
 
@@ -77,9 +72,9 @@ void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
 
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
         reportCurrentException(exec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index be3df29..42fcbce 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -32,31 +32,28 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionErrorCallback.h"
-
-#include <runtime/JSObject.h>
+#include "JSDOMGlobalObject.h"
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class SQLError;
 
 class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, globalObject));
+    }
     
     virtual void handleEvent(SQLError*);
 
 private:
-    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
index 2273ff0..5300c42 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -38,22 +38,18 @@ namespace WebCore {
     
 using namespace JSC;
     
-JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, Frame* frame)
+JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
     
 void JSCustomVoidCallback::handleEvent()
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
-       
-    if (!m_frame->script()->isEnabled())
-        return;
-        
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ASSERT(m_globalObject);
+
+    ExecState* exec = m_globalObject->globalExec();
         
     JSC::JSLock lock(SilenceAssertionsOnly);
         
@@ -73,27 +69,14 @@ void JSCustomVoidCallback::handleEvent()
         
     MarkedArgumentBuffer args;
     
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
-        
+    m_globalObject->globalData()->timeoutChecker.stop();
+
     if (exec->hadException())
         reportCurrentException(exec);
         
     Document::updateStyleForAllDocuments();
 }
- 
-PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue value)
-{
-    JSObject* object = value.getObject();
-    if (!object)
-        return 0;
-    
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return 0;
-    
-    return JSCustomVoidCallback::create(object, frame);
-}
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
index 9cd7c34..f3db49f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -29,33 +29,28 @@
 #ifndef JSCustomVoidCallback_h
 #define JSCustomVoidCallback_h
 
+#include "JSDOMGlobalObject.h"
 #include "VoidCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
+
+class JSCustomVoidCallback : public VoidCallback {
+public: 
+    static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomVoidCallback(callback, globalObject));
+    }
     
-    class Frame;
+    virtual void handleEvent();
     
-    class JSCustomVoidCallback : public VoidCallback {
-    public: 
-        static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, Frame* frame)
-        {
-            return adoptRef(new JSCustomVoidCallback(callback, frame));
-        }
-        
-        virtual void handleEvent();
-        
-    private:
-        JSCustomVoidCallback(JSC::JSObject* callback, Frame*);
-
-        JSC::ProtectedPtr<JSC::JSObject> m_callback;
-        RefPtr<Frame> m_frame;
-    };
+private:
+    JSCustomVoidCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue);
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 55e6481..4476be5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -95,9 +95,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
-    globalObject->globalData()->timeoutChecker->start();
+    globalObject->globalData()->timeoutChecker.start();
     JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    globalObject->globalData()->timeoutChecker.stop();
 
     String result;
     if (exec->hadException())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index a7fae78..b833e71 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -42,25 +42,25 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSDOMApplicationCache::mark()
+void JSDOMApplicationCache::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
-    markIfNotNull(m_impl->onchecking());
-    markIfNotNull(m_impl->onerror());
-    markIfNotNull(m_impl->onnoupdate());
-    markIfNotNull(m_impl->ondownloading());
-    markIfNotNull(m_impl->onprogress());
-    markIfNotNull(m_impl->onupdateready());
-    markIfNotNull(m_impl->oncached());
-    markIfNotNull(m_impl->onobsolete());
+    markIfNotNull(markStack, m_impl->onchecking());
+    markIfNotNull(markStack, m_impl->onerror());
+    markIfNotNull(markStack, m_impl->onnoupdate());
+    markIfNotNull(markStack, m_impl->ondownloading());
+    markIfNotNull(markStack, m_impl->onprogress());
+    markIfNotNull(markStack, m_impl->onupdateready());
+    markIfNotNull(markStack, m_impl->oncached());
+    markIfNotNull(markStack, m_impl->onobsolete());
 
     typedef DOMApplicationCache::EventListenersMap EventListenersMap;
     typedef DOMApplicationCache::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -112,10 +112,12 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -124,10 +126,12 @@ JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgLis
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 910da12..df384ea 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -18,11 +18,6 @@
  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-// gcc 3.x can't handle including the HashMap pointer specialization in this file
-#if defined __GNUC__ && !defined __GLIBCXX__ // less than gcc 3.4
-#define HASH_MAP_PTR_SPEC_WORKAROUND 1
-#endif
-
 #include "config.h"
 #include "JSDOMBinding.h"
 
@@ -33,6 +28,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLAudioElement.h"
+#include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
 #include "HTMLScriptElement.h"
 #include "HTMLNames.h"
@@ -47,6 +43,8 @@
 #include "RangeException.h"
 #include "ScriptController.h"
 #include "XMLHttpRequestException.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 #include <wtf/StdLibExtras.h>
 
@@ -269,18 +267,48 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
     Node* node = jsNode->impl();
 
     if (node->inDocument()) {
-        // 1. If a node is in the document, and its wrapper has custom properties,
+        // If a node is in the document, and its wrapper has custom properties,
         // the wrapper is observable because future access to the node through the
         // DOM must reflect those properties.
         if (jsNode->hasCustomProperties())
             return true;
 
-        // 2. If a node is in the document, and has event listeners, its wrapper is
+        // If a node is in the document, and has event listeners, its wrapper is
         // observable because its wrapper is responsible for marking those event listeners.
         if (node->eventListeners().size())
             return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
+
+        // If a node owns another object with a wrapper with custom properties,
+        // the wrapper must be treated as observable, because future access to
+        // those objects through the DOM must reflect those properties.
+        // FIXME: It would be better if this logic could be in the node next to
+        // the custom markChildren functions rather than here.
+        if (node->isElementNode()) {
+            if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
+                if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), attributes)) {
+                    if (wrapper->hasCustomProperties())
+                        return true;
+                }
+            }
+            if (node->isStyledElement()) {
+                if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), style)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+            if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
+                if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), context)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+        }
     } else {
-        // 3. If a wrapper is the last reference to an image or script element
+        // If a wrapper is the last reference to an image or script element
         // that is loading but not in the document, the wrapper is observable
         // because it is the only thing keeping the image element alive, and if
         // the image element is destroyed, its load event will not fire.
@@ -298,18 +326,18 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
     return false;
 }
 
-void markDOMNodesForDocument(Document* doc)
+void markDOMNodesForDocument(MarkStack& markStack, Document* doc)
 {
     JSWrapperCache& nodeDict = doc->wrapperCache();
     JSWrapperCache::iterator nodeEnd = nodeDict.end();
     for (JSWrapperCache::iterator nodeIt = nodeDict.begin(); nodeIt != nodeEnd; ++nodeIt) {
         JSNode* jsNode = nodeIt->second;
-        if (!jsNode->marked() && isObservableThroughDOM(jsNode))
-            jsNode->mark();
+        if (isObservableThroughDOM(jsNode))
+            markStack.append(jsNode);
     }
 }
 
-void markActiveObjectsForContext(JSGlobalData& globalData, ScriptExecutionContext* scriptExecutionContext)
+void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData, ScriptExecutionContext* scriptExecutionContext)
 {
     // If an element has pending activity that may result in event listeners being called
     // (e.g. an XMLHttpRequest), we need to keep JS wrappers alive.
@@ -322,8 +350,8 @@ void markActiveObjectsForContext(JSGlobalData& globalData, ScriptExecutionContex
             // Generally, an active object with pending activity must have a wrapper to mark its listeners.
             // However, some ActiveDOMObjects don't have JS wrappers (timers created by setTimeout is one example).
             // FIXME: perhaps need to make sure even timers have a markable 'wrapper'.
-            if (wrapper && !wrapper->marked())
-                wrapper->mark();
+            if (wrapper)
+                markStack.append(wrapper);
         }
     }
 
@@ -333,8 +361,8 @@ void markActiveObjectsForContext(JSGlobalData& globalData, ScriptExecutionContex
         // If the message port is remotely entangled, then always mark it as in-use because we can't determine reachability across threads.
         if (!(*iter)->locallyEntangledPort() || (*iter)->hasPendingActivity()) {
             DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, *iter);
-            if (wrapper && !wrapper->marked())
-                wrapper->mark();
+            if (wrapper)
+                markStack.append(wrapper);
         }
     }
 }
@@ -351,14 +379,17 @@ void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocum
     addWrapper(wrapper);
 }
 
-void markDOMObjectWrapper(JSGlobalData& globalData, void* object)
+void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void* object)
 {
+    // FIXME: This could be changed to only mark wrappers that are "observable"
+    // as markDOMNodesForDocument does, allowing us to collect more wrappers,
+    // but doing this correctly would be challenging.
     if (!object)
         return;
     DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, object);
-    if (!wrapper || wrapper->marked())
+    if (!wrapper)
         return;
-    wrapper->mark();
+    markStack.append(wrapper);
 }
 
 JSValue jsStringOrNull(ExecState* exec, const String& s)
@@ -594,4 +625,27 @@ void cacheDOMConstructor(ExecState* exec, const ClassInfo* classInfo, JSObject*
     constructors.set(classInfo, constructor);
 }
 
+JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
+{
+    JSObject* object = value.getObject();
+    if (!object) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+    JSValue lengthValue = object->get(exec, exec->propertyNames().length);
+    if (exec->hadException())
+        return 0;
+
+    if (lengthValue.isUndefinedOrNull()) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+
+    length = lengthValue.toUInt32(exec);
+    if (exec->hadException())
+        return 0;
+
+    return object;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 3975940..c3ab266 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
  *  Copyright (C) 2009 Google, Inc. All rights reserved.
  *
@@ -26,7 +26,6 @@
 #include "Document.h" // For DOMConstructorWithDocument
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
-#include <runtime/JSFunction.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -61,7 +60,7 @@ namespace WebCore {
 #endif
     };
 
-    // FIXME: This class should colapse into DOMObject once all DOMObjects are
+    // FIXME: This class should collapse into DOMObject once all DOMObjects are
     // updated to store a globalObject pointer.
     class DOMObjectWithGlobalPointer : public DOMObject {
     public:
@@ -73,6 +72,11 @@ namespace WebCore {
             return m_globalObject->scriptExecutionContext();
         }
 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        {
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot));
+        }
+
     protected:
         DOMObjectWithGlobalPointer(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
@@ -83,13 +87,12 @@ namespace WebCore {
             // needing to reach through the frame to get to the Document*.  See bug 27640.
             // ASSERT(globalObject->scriptExecutionContext());
         }
-        virtual ~DOMObjectWithGlobalPointer() {}
+        virtual ~DOMObjectWithGlobalPointer() { }
 
-        void mark()
+        void markChildren(JSC::MarkStack& markStack)
         {
-            DOMObject::mark();
-            if (!m_globalObject->marked())
-                m_globalObject->mark();
+            DOMObject::markChildren(markStack);
+            markStack.append(m_globalObject);
         }
 
     private:
@@ -137,9 +140,9 @@ namespace WebCore {
     void forgetDOMNode(Document*, Node*);
     void forgetAllDOMNodesForDocument(Document*);
     void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
-    void markDOMNodesForDocument(Document*);
-    void markActiveObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
-    void markDOMObjectWrapper(JSC::JSGlobalData& globalData, void* object);
+    void markDOMNodesForDocument(JSC::MarkStack&, Document*);
+    void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
+    void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
@@ -278,6 +281,9 @@ namespace WebCore {
         return toJS(exec, globalObject, ptr.get());
     }
 
+    // Validates that the passed object is a sequence type per section 4.1.13 of the WebIDL spec.
+    JSC::JSObject* toJSSequence(JSC::ExecState*, JSC::JSValue, unsigned&);
+
     bool checkNodeSecurity(JSC::ExecState*, Node*);
 
     // Helpers for Window, History, and Location classes to implement cross-domain policy.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index a7f7b21..240a56c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -50,47 +50,17 @@ JSDOMGlobalObject::JSDOMGlobalObject(PassRefPtr<Structure> structure, JSDOMGloba
 {
 }
 
-JSDOMGlobalObject::~JSDOMGlobalObject()
+void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 {
-    JSListenersMap::iterator it = d()->jsEventListeners.begin();
-    JSListenersMap::iterator end = d()->jsEventListeners.end();
-    for (; it != end; ++it)
-        it->second->clearGlobalObject();
-}
-
-void JSDOMGlobalObject::mark()
-{
-    Base::mark();
+    Base::markChildren(markStack);
 
     JSDOMStructureMap::iterator end = structures().end();
     for (JSDOMStructureMap::iterator it = structures().begin(); it != end; ++it)
-        it->second->mark();
+        it->second->markAggregate(markStack);
 
     JSDOMConstructorMap::iterator end2 = constructors().end();
-    for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2) {
-        if (!it2->second->marked())
-            it2->second->mark();
-    }
-}
-
-JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue val)
-{
-    if (!val.isObject())
-        return 0;
-
-    return d()->jsEventListeners.get(asObject(val));
-}
-
-PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(JSValue val)
-{
-    if (JSEventListener* listener = findJSEventListener(val))
-        return listener;
-
-    if (!val.isObject())
-        return 0;
-
-    // The JSEventListener constructor adds it to our jsEventListeners map.
-    return JSEventListener::create(asObject(val), this, false).get();
+    for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
+        markStack.append(it2->second);
 }
 
 PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
@@ -101,11 +71,6 @@ PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JS
     return JSEventListener::create(asObject(val), this, true).get();
 }
 
-JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsEventListeners()
-{
-    return d()->jsEventListeners;
-}
-
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
 {
     d()->evt = evt;
@@ -116,10 +81,15 @@ Event* JSDOMGlobalObject::currentEvent() const
     return d()->evt;
 }
 
+JSDOMGlobalObject* toJSDOMGlobalObject(Document* document)
+{
+    return toJSDOMWindow(document->frame());
+}
+
 JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext* scriptExecutionContext)
 {
     if (scriptExecutionContext->isDocument())
-        return toJSDOMWindow(static_cast<Document*>(scriptExecutionContext)->frame());
+        return toJSDOMGlobalObject(static_cast<Document*>(scriptExecutionContext));
 
 #if ENABLE(WORKERS)
     if (scriptExecutionContext->isWorkerContext())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index bc6c1f2..996e155 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -31,6 +31,7 @@
 
 namespace WebCore {
 
+    class Document;
     class Event;
     class JSLazyEventListener;
     class JSEventListener;
@@ -45,7 +46,6 @@ namespace WebCore {
         struct JSDOMGlobalObjectData;
 
         JSDOMGlobalObject(PassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
-        virtual ~JSDOMGlobalObject();
 
     public:
         JSDOMStructureMap& structures() { return d()->structures; }
@@ -53,27 +53,17 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
-        JSEventListener* findJSEventListener(JSC::JSValue);
-
-        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
-        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::JSValue);
-
-        // Creates a GC-protected JS EventListener for an "onXXX" event attribute.
-        // These listeners cannot be removed through the removeEventListener API.
+        // Creates a JS EventListener for an "onXXX" event attribute. These
+        // listeners cannot be removed through the removeEventListener API.
         PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
 
-        typedef HashMap<JSC::JSObject*, JSEventListener*> JSListenersMap;
-
-        JSListenersMap& jsEventListeners();
-
         // Make binding code generation easier.
         JSDOMGlobalObject* globalObject() { return this; }
 
         void setCurrentEvent(Event*);
         Event* currentEvent() const;
 
-        virtual void mark();
+        virtual void markChildren(JSC::MarkStack&);
 
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
@@ -82,8 +72,6 @@ namespace WebCore {
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
-            JSDOMGlobalObject::JSListenersMap jsEventListeners;
-
             Event* evt;
         };
 
@@ -102,6 +90,7 @@ namespace WebCore {
         return constructor;
     }
 
+    JSDOMGlobalObject* toJSDOMGlobalObject(Document*);
     JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext*);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index cf81f54..6eca3e7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -113,7 +113,7 @@ ExecState* JSDOMWindowBase::globalExec()
 
 bool JSDOMWindowBase::supportsProfiling() const
 {
-#if !ENABLE(JAVASCRIPT_DEBUGGER)
+#if !ENABLE(JAVASCRIPT_DEBUGGER) || !ENABLE(INSPECTOR)
     return false;
 #else
     Frame* frame = impl()->frame();
@@ -166,7 +166,10 @@ JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
     static JSGlobalData* globalData;
     if (!globalData) {
         globalData = JSGlobalData::createLeaked().releaseRef();
-        globalData->timeoutChecker->setTimeoutInterval(10000); // 10 seconds
+        globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
+#ifndef NDEBUG
+        globalData->mainThreadOnly = true;
+#endif
     }
 
     return globalData;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 93eae74..27e95fe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -38,22 +38,42 @@
 #include "JSDOMWindowShell.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSEventSourceConstructor.h"
 #include "JSHTMLCollection.h"
 #include "JSHistory.h"
 #include "JSImageConstructor.h"
 #include "JSLocation.h"
 #include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSMessagePortCustom.h"
 #include "JSOptionConstructor.h"
+
+#if ENABLE(SHARED_WORKERS)
 #include "JSSharedWorkerConstructor.h"
+#endif
+
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArrayConstructor.h"
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+#include "JSCanvasIntArrayConstructor.h"
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+#include "JSCanvasShortArrayConstructor.h"
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+#include "JSCanvasFloatArrayConstructor.h"
+#endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocketConstructor.h"
+#endif
 #include "JSWorkerConstructor.h"
 #include "JSXMLHttpRequestConstructor.h"
 #include "JSXSLTProcessorConstructor.h"
 #include "Location.h"
 #include "MediaPlayer.h"
 #include "MessagePort.h"
+#include "NotificationCenter.h"
 #include "Page.h"
 #include "PlatformScreen.h"
 #include "RegisteredEventListener.h"
@@ -61,6 +81,8 @@
 #include "ScriptController.h"
 #include "Settings.h"
 #include "WindowFeatures.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSObject.h>
 #include <runtime/PrototypeFunction.h>
 
@@ -68,32 +90,32 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSDOMWindow::mark()
+void JSDOMWindow::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
-    markEventListeners(impl()->eventListeners());
+    markEventListeners(markStack, impl()->eventListeners());
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
-    markDOMObjectWrapper(globalData, impl()->optionalConsole());
-    markDOMObjectWrapper(globalData, impl()->optionalHistory());
-    markDOMObjectWrapper(globalData, impl()->optionalLocationbar());
-    markDOMObjectWrapper(globalData, impl()->optionalMenubar());
-    markDOMObjectWrapper(globalData, impl()->optionalNavigator());
-    markDOMObjectWrapper(globalData, impl()->optionalPersonalbar());
-    markDOMObjectWrapper(globalData, impl()->optionalScreen());
-    markDOMObjectWrapper(globalData, impl()->optionalScrollbars());
-    markDOMObjectWrapper(globalData, impl()->optionalSelection());
-    markDOMObjectWrapper(globalData, impl()->optionalStatusbar());
-    markDOMObjectWrapper(globalData, impl()->optionalToolbar());
-    markDOMObjectWrapper(globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalConsole());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalHistory());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalLocationbar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalMenubar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalPersonalbar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalScreen());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalScrollbars());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalSelection());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalStatusbar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalToolbar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
 #if ENABLE(DOM_STORAGE)
-    markDOMObjectWrapper(globalData, impl()->optionalSessionStorage());
-    markDOMObjectWrapper(globalData, impl()->optionalLocalStorage());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalSessionStorage());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalLocalStorage());
 #endif
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    markDOMObjectWrapper(globalData, impl()->optionalApplicationCache());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalApplicationCache());
 #endif
 }
 
@@ -271,6 +293,150 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
+    // are not affected by properties changed on the Window or anything in its prototype chain.
+    // This is consistent with the behavior of Firefox.
+    
+    const HashEntry* entry;
+    
+    // We don't want any properties other than "close" and "closed" on a closed window.
+    if (!impl()->frame()) {
+        // The following code is safe for cross-domain and same domain use.
+        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
+        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && !(entry->attributes() & Function) && entry->propertyGetter() == jsDOMWindowClosed) {
+            descriptor.setDescriptor(jsBoolean(true), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && (entry->attributes() & Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
+            PropertySlot slot;
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        descriptor.setUndefined();
+        return true;
+    }
+
+    String errorMessage;
+    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
+    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+
+    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
+    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
+    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
+    // what prototype is actually set on this object.
+    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    descriptor.setUndefined();
+                    return true;
+                }
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.prototype.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            if (!allowsAccess) {
+                PropertySlot slot;
+                slot.setCustom(this, objectToStringFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                return true;
+            }
+        }
+    }
+    
+    entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    
+    // Check for child frames by name before built-in properties to
+    // match Mozilla. This does not match IE, but some sites end up
+    // naming frames things that conflict with window properties that
+    // are in Moz but not IE. Since we have some of these, we have to do
+    // it the Moz way.
+    if (impl()->frame()->tree()->child(propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, childFrameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    // Do prototype lookup early so that functions and attributes in the prototype can have
+    // precedence over the index and name getters.  
+    JSValue proto = prototype();
+    if (proto.isObject()) {
+        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
+            if (!allowsAccess) {
+                printErrorMessage(errorMessage);
+                descriptor.setUndefined();
+            }
+            return true;
+        }
+    }
+
+    bool ok;
+    unsigned i = propertyName.toArrayIndex(&ok);
+    if (ok && i < impl()->frame()->tree()->childCount()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, i, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+
+    // Allow shortcuts like 'Image1' instead of document.images.Image1
+    Document* document = impl()->frame()->document();
+    if (document->isHTMLDocument()) {
+        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
+        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
+            PropertySlot slot;
+            slot.setCustom(this, namedItemGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+    }
+    
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!impl()->frame())
@@ -290,20 +456,28 @@ void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue v
         Base::put(exec, propertyName, value, slot);
 }
 
-bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow deleting properties by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return false;
-    return Base::deleteProperty(exec, propertyName, checkDontDelete);
+    return Base::deleteProperty(exec, propertyName);
 }
 
-void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::getPropertyNames(exec, propertyNames, listedAttributes);
+    Base::getPropertyNames(exec, propertyNames);
+}
+
+void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    // Only allow the window to enumerated by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return;
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
@@ -424,6 +598,13 @@ JSValue JSDOMWindow::event(ExecState* exec) const
     return toJS(exec, event);
 }
 
+#if ENABLE(EVENTSOURCE)
+JSValue JSDOMWindow::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSDOMWindow::image(ExecState* exec) const
 {
     return getDOMConstructor<JSImageConstructor>(exec, this);
@@ -453,6 +634,48 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
     return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec, this);
 }
  
+#if ENABLE(3D_CANVAS)
+JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+}
+#endif
+ 
 JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -486,6 +709,13 @@ JSValue JSDOMWindow::sharedWorker(ExecState* exec) const
 }
 #endif
 
+#if ENABLE(WEB_SOCKETS)
+JSValue JSDOMWindow::webSocket(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebSocketConstructor>(exec, this);
+}
+#endif
+
 // Custom functions
 
 // Helper for window.open() and window.showModalDialog()
@@ -529,7 +759,7 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
 
     if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
-        KURL completedURL = url.isEmpty() ? KURL("") : completeURL(exec, url);
+        KURL completedURL = url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(exec, url);
         bool userGesture = processingUserGesture(exec);
 
         if (created)
@@ -700,14 +930,18 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
     if (exec->hadException())
         return jsUndefined();
 
-    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(1));
+    MessagePortArray messagePorts;
+    if (args.size() > 2)
+        fillMessagePortArray(exec, args.at(1), messagePorts);
+    if (exec->hadException())
+        return jsUndefined();
 
     String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at((args.size() == 2) ? 1 : 2));
     if (exec->hadException())
         return jsUndefined();
 
     ExceptionCode ec = 0;
-    window->postMessage(message, messagePort, targetOrigin, source, ec);
+    window->postMessage(message, &messagePorts, targetOrigin, source, ec);
     setDOMException(exec, ec);
 
     return jsUndefined();
@@ -788,9 +1022,11 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(AtomicString(args.at(0).toString(exec)), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -800,9 +1036,11 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (JSEventListener* listener = findJSEventListener(args.at(1)))
-        impl()->removeEventListener(AtomicString(args.at(0).toString(exec)), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index ec31721..f969dc1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -71,11 +71,11 @@ void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
 // JSObject methods
 // ----
 
-void JSDOMWindowShell::mark()
+void JSDOMWindowShell::markChildren(MarkStack& markStack)
 {
-    Base::mark();
-    if (m_window && !m_window->marked())
-        m_window->mark();
+    Base::markChildren(markStack);
+    if (m_window)
+        markStack.append(m_window);
 }
 
 UString JSDOMWindowShell::className() const
@@ -88,6 +88,11 @@ bool JSDOMWindowShell::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return m_window->getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindowShell::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return m_window->getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_window->put(exec, propertyName, value, slot);
@@ -98,14 +103,19 @@ void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& prop
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
 
-bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    return m_window->deleteProperty(exec, propertyName);
+}
+
+void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    return m_window->deleteProperty(exec, propertyName, checkDontDelete);
+    m_window->getPropertyNames(exec, propertyNames);
 }
 
-void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_window->getPropertyNames(exec, propertyNames, listedAttributes);
+    m_window->getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 87b63fc..a7c2c56 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -64,13 +64,15 @@ namespace WebCore {
         }
 
     private:
-        virtual void mark();
+        virtual void markChildren(JSC::MarkStack&);
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
-        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName, bool checkDontDelete = true);
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
index af3b066..0932cca 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -52,17 +52,13 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     String oldVersion = args.at(0).toString(exec);
     String newVersion = args.at(1).toString(exec);
 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
     JSObject* object;
     if (!(object = args.at(2).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }
     
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject())));
     
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     if (!args.at(3).isNull()) {
@@ -71,24 +67,25 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<VoidCallback> successCallback;
     if (!args.at(4).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(4));
-        if (!successCallback) {
+        if (!(object = args.at(4).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
-    
+
     m_impl->changeVersion(oldVersion, newVersion, callback.release(), errorCallback.release(), successCallback.release());
     
     return jsUndefined();
 }
 
-JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+static JSValue createTransaction(ExecState* exec, const ArgList& args, Database* database, JSDOMGlobalObject* globalObject, bool readOnly)
 {
     JSObject* object;
     
@@ -96,12 +93,8 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }        
- 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+     
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, globalObject));
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     
     if (args.size() > 1 && !args.at(1).isNull()) {
@@ -110,22 +103,33 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
 
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, globalObject);
     }
 
     RefPtr<VoidCallback> successCallback;
     if (args.size() > 2 && !args.at(2).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(2));
-        if (!successCallback) {
+        if (!(object = args.at(2).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, globalObject);
     }
     
-    m_impl->transaction(callback.release(), errorCallback.release(), successCallback.release());
-
+    database->transaction(callback.release(), errorCallback.release(), successCallback.release(), readOnly);
     return jsUndefined();
 }
+
+JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), false);
+}
     
+JSValue JSDatabase::readTransaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), true);
+}
+
 }
+
 #endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
index c45a6a3..a633a42 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -34,15 +35,23 @@
 
 #include "JSDedicatedWorkerContext.h"
 
+#include "JSDOMBinding.h"
+#include "JSMessagePortCustom.h"
+
 using namespace JSC;
 
 namespace WebCore {
 
-void JSDedicatedWorkerContext::mark()
+void JSDedicatedWorkerContext::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
+
+    markIfNotNull(markStack, impl()->onmessage());
+}
 
-    markIfNotNull(impl()->onmessage());
+JSC::JSValue JSDedicatedWorkerContext::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
new file mode 100644
index 0000000..493d7bd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Document.h"
+#include "JSCustomVoidCallback.h"
+#include "JSEventListener.h"
+#include "JSNotification.h"
+#include "JSNotificationCenter.h"
+#include "Notification.h"
+#include "NotificationCenter.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSNotificationCenter::requestPermission(ExecState* exec, const ArgList& args)
+{
+    // Permission request is only valid from page context.
+    ScriptExecutionContext* context = impl()->context();
+    if (context->isWorkerContext())
+        return throwError(exec, SyntaxError);
+
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError);
+
+    PassRefPtr<JSCustomVoidCallback> callback = JSCustomVoidCallback::create(args.at(0).getObject(), static_cast<Document*>(context)->frame());
+
+    impl()->requestPermission(callback);
+    return jsUndefined();
+}
+
+JSValue JSNotification::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), globalObject, false), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSNotification::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+
+} // namespace
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index 493aaea..e48b593 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,6 +24,10 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
 #include "JSLocation.h"
@@ -35,15 +39,23 @@
 #include "SVGDocument.h"
 #endif
 
+#include <wtf/GetPtr.h>
+
 using namespace JSC;
 
 namespace WebCore {
 
-void JSDocument::mark()
+void JSDocument::markChildren(MarkStack& markStack)
 {
-    JSNode::mark();
-    markDOMNodesForDocument(impl());
-    markActiveObjectsForContext(*Heap::heap(this)->globalData(), impl());
+    JSNode::markChildren(markStack);
+
+    Document* document = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMNodesForDocument(markStack, document);
+    markActiveObjectsForContext(markStack, globalData, document);
+    markDOMObjectWrapper(markStack, globalData, document->implementation());
+    markDOMObjectWrapper(markStack, globalData, document->styleSheets());
 }
 
 JSValue JSDocument::location(ExecState* exec) const
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
index 47793d0..fb64ff2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,15 +51,27 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+void JSElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    Element* element = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, element->attributeMap());
+    if (element->isStyledElement())
+        markDOMObjectWrapper(markStack, globalData, static_cast<StyledElement*>(element)->inlineStyleDecl());
+}
+
 static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
     if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(deprecatedParseURL(value))) {
-        HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
-        if (!checkNodeSecurity(exec, frame->contentDocument()))
+        Document* contentDocument = static_cast<HTMLFrameElementBase*>(element)->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
-} 
+}
 
 JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index 257c259..162543d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -38,6 +38,7 @@
 #include "JSMouseEvent.h"
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
+#include "JSPageTransitionEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -51,6 +52,7 @@
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
+#include "PageTransitionEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -111,6 +113,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, OverflowEvent, event);
     else if (event->isMessageEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, MessageEvent, event);
+    else if (event->isPageTransitionEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PageTransitionEvent, event);
     else if (event->isProgressEvent()) {
         if (event->isXMLHttpRequestProgressEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, XMLHttpRequestProgressEvent, event);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index c7797be..d391073 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -32,18 +32,16 @@ using namespace JSC;
 namespace WebCore {
 
 JSEventListener::JSEventListener(JSObject* function, JSDOMGlobalObject* globalObject, bool isAttribute)
-    : m_jsFunction(function)
+    : EventListener(JSEventListenerType)
+    , m_jsFunction(function)
     , m_globalObject(globalObject)
     , m_isAttribute(isAttribute)
 {
-    if (!m_isAttribute && m_jsFunction)
-        globalObject->jsEventListeners().set(m_jsFunction, this);
+    ASSERT(m_globalObject);
 }
 
 JSEventListener::~JSEventListener()
 {
-    if (!m_isAttribute && m_jsFunction && m_globalObject)
-        m_globalObject->jsEventListeners().remove(m_jsFunction);
 }
 
 JSObject* JSEventListener::jsFunction() const
@@ -51,12 +49,11 @@ JSObject* JSEventListener::jsFunction() const
     return m_jsFunction;
 }
 
-void JSEventListener::markJSFunction()
+void JSEventListener::markJSFunction(MarkStack& markStack)
 {
-    if (m_jsFunction && !m_jsFunction->marked())
-        m_jsFunction->mark();
-    if (m_globalObject && !m_globalObject->marked())
-        m_globalObject->mark();
+    if (m_jsFunction)
+        markStack.append(m_jsFunction);
+    markStack.append(m_globalObject);
 }
 
 void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
@@ -68,13 +65,6 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
         return;
 
     JSDOMGlobalObject* globalObject = m_globalObject;
-    // Null check as clearGlobalObject() can clear this and we still get called back by
-    // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
-    // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
-    ASSERT(globalObject);
-    if (!globalObject)
-        return;
-
     ScriptExecutionContext* scriptExecutionContext = globalObject->scriptExecutionContext();
     if (!scriptExecutionContext)
         return;
@@ -113,15 +103,12 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
         Event* savedEvent = globalObject->currentEvent();
         globalObject->setCurrentEvent(event);
 
-        // If this event handler is the first JavaScript to execute, then the
-        // dynamic global object should be set to the global object of the
-        // window in which the event occurred.
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
         JSValue retval;
         if (handleEventFunction) {
-            globalObject->globalData()->timeoutChecker->start();
+            globalData->timeoutChecker.start();
             retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
         } else {
             JSValue thisValue;
@@ -129,10 +116,10 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
                 thisValue = globalObject->toThisObject(exec);
             else
                 thisValue = toJS(exec, globalObject, event->currentTarget());
-            globalObject->globalData()->timeoutChecker->start();
+            globalData->timeoutChecker.start();
             retval = call(exec, jsFunction, callType, callData, thisValue, args);
         }
-        globalObject->globalData()->timeoutChecker->stop();
+        globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
 
@@ -163,9 +150,6 @@ bool JSEventListener::reportError(const String& message, const String& url, int
         return false;
 
     JSDOMGlobalObject* globalObject = m_globalObject;
-    if (!globalObject)
-        return false;
-
     ExecState* exec = globalObject->globalExec();
 
     CallData callData;
@@ -179,17 +163,14 @@ bool JSEventListener::reportError(const String& message, const String& url, int
     args.append(jsString(exec, url));
     args.append(jsNumber(exec, lineNumber));
 
-    // If this event handler is the first JavaScript to execute, then the
-    // dynamic global object should be set to the global object of the
-    // window in which the event occurred.
     JSGlobalData* globalData = globalObject->globalData();
     DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);    
 
     JSValue thisValue = globalObject->toThisObject(exec);
 
-    globalObject->globalData()->timeoutChecker->start();
+    globalData->timeoutChecker.start();
     JSValue returnValue = call(exec, jsFunction, callType, callData, thisValue, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
     if (exec->hadException()) {
@@ -206,4 +187,11 @@ bool JSEventListener::virtualisAttribute() const
     return m_isAttribute;
 }
 
+bool JSEventListener::operator==(const EventListener& listener)
+{
+    if (const JSEventListener* jsEventListener = JSEventListener::cast(&listener))
+        return m_jsFunction == jsEventListener->m_jsFunction && m_isAttribute == jsEventListener->m_isAttribute;
+    return false;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index 2497750..92f0c41 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -34,8 +34,17 @@ namespace WebCore {
         {
             return adoptRef(new JSEventListener(listener, globalObject, isAttribute));
         }
+
+        static const JSEventListener* cast(const EventListener* listener)
+        {
+            return listener->type() == JSEventListenerType
+                ? static_cast<const JSEventListener*>(listener)
+                : 0;
+        }
+
         virtual ~JSEventListener();
-        void clearGlobalObject() { m_globalObject = 0; }
+
+        virtual bool operator==(const EventListener& other);
 
         // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
         bool isAttribute() const { return m_isAttribute; }
@@ -43,7 +52,7 @@ namespace WebCore {
         virtual JSC::JSObject* jsFunction() const;
 
     private:
-        virtual void markJSFunction();
+        virtual void markJSFunction(JSC::MarkStack&);
         virtual void handleEvent(Event*, bool isWindowEvent);
         virtual bool reportError(const String& message, const String& url, int lineNumber);
         virtual bool virtualisAttribute() const;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.cpp
new file mode 100644
index 0000000..c6e4825
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSourceConstructor.h"
+
+#include "EventSource.h"
+#include "ExceptionCode.h"
+#include "JSEventSource.h"
+#include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSEventSourceConstructor);
+
+const ClassInfo JSEventSourceConstructor::s_info = { "EventSourceContructor", 0, 0, 0 };
+
+JSEventSourceConstructor::JSEventSourceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSEventSourceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSEventSourcePrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructEventSource(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    UString url = args.at(0).toString(exec);
+    if (exec->hadException())
+        return 0;
+
+    JSEventSourceConstructor* jsConstructor =  static_cast<JSEventSourceConstructor*>(constructor);
+    ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "EventSource constructor associated document is unavailable");
+
+    ExceptionCode ec = 0;
+    RefPtr<EventSource> eventSource = EventSource::create(url, context, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return 0;
+    }
+
+    return asObject(toJS(exec, jsConstructor->globalObject(), eventSource.release()));
+}
+
+ConstructType JSEventSourceConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructEventSource;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.h
new file mode 100644
index 0000000..b2f3cb5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSEventSourceConstructor_h
+#define JSEventSourceConstructor_h
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class JSEventSourceConstructor : public DOMConstructorObject {
+    public:
+        JSEventSourceConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
+
+#endif // JSEventSourceConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
new file mode 100644
index 0000000..deebcb9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSource.h"
+
+#include "EventSource.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEventListener.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSEventSource::markChildren(MarkStack& markStack)
+{
+    DOMObject::markChildren(markStack);
+
+    markIfNotNull(markStack, m_impl->onopen());
+    markIfNotNull(markStack, m_impl->onmessage());
+    markIfNotNull(markStack, m_impl->onerror());
+
+    typedef EventSource::EventListenersMap EventListenersMap;
+    typedef EventSource::ListenerVector ListenerVector;
+    EventListenersMap& eventListeners = m_impl->eventListeners();
+    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction(markStack);
+    }
+}
+
+JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
index b75cccf..0421d10 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
@@ -33,12 +33,29 @@
 #include "JSEventListener.h"
 #include "JSMessagePort.h"
 #include "JSNode.h"
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSSharedWorker.h"
+#include "JSSharedWorkerContext.h"
+#endif
+
 #include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestUpload.h"
 #include "MessagePort.h"
+
+#if ENABLE(SHARED_WORKERS)
+#include "SharedWorker.h"
+#include "SharedWorkerContext.h"
+#endif
+
 #include "XMLHttpRequest.h"
 #include "XMLHttpRequestUpload.h"
 
+#if ENABLE(EVENTSOURCE)
+#include "EventSource.h"
+#include "JSEventSource.h"
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 #include "DOMApplicationCache.h"
 #include "JSDOMApplicationCache.h"
@@ -56,9 +73,14 @@
 #include "Worker.h"
 #endif
 
-#if ENABLE(SHARED_WORKERS)
-#include "JSSharedWorker.h"
-#include "SharedWorker.h"
+#if ENABLE(NOTIFICATIONS)
+#include "JSNotification.h"
+#include "Notification.h"
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocket.h"
+#include "WebSocket.h"
 #endif
 
 using namespace JSC;
@@ -70,6 +92,11 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
     if (!target)
         return jsNull();
     
+#if ENABLE(EVENTSOURCE)
+    if (EventSource* eventSource = target->toEventSource())
+        return toJS(exec, globalObject, eventSource);
+#endif
+
 #if ENABLE(SVG)
     // SVGElementInstance supports both toSVGElementInstance and toNode since so much mouse handling code depends on toNode returning a valid node.
     if (SVGElementInstance* instance = target->toSVGElementInstance())
@@ -107,6 +134,19 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
 #if ENABLE(SHARED_WORKERS)
     if (SharedWorker* sharedWorker = target->toSharedWorker())
         return toJS(exec, globalObject, sharedWorker);
+
+    if (SharedWorkerContext* workerContext = target->toSharedWorkerContext())
+        return toJSDOMGlobalObject(workerContext);
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+    if (Notification* notification = target->toNotification())
+        return toJS(exec, notification);
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    if (WebSocket* webSocket = target->toWebSocket())
+        return toJS(exec, webSocket);
 #endif
 
     ASSERT_NOT_REACHED();
@@ -116,7 +156,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
 EventTarget* toEventTarget(JSC::JSValue value)
 {
     #define CONVERT_TO_EVENT_TARGET(type) \
-        if (value.isObject(&JS##type::s_info)) \
+        if (value.inherits(&JS##type::s_info)) \
             return static_cast<JS##type*>(asObject(value))->impl();
 
     CONVERT_TO_EVENT_TARGET(Node)
@@ -124,9 +164,13 @@ EventTarget* toEventTarget(JSC::JSValue value)
     CONVERT_TO_EVENT_TARGET(XMLHttpRequestUpload)
     CONVERT_TO_EVENT_TARGET(MessagePort)
 
-    if (value.isObject(&JSDOMWindowShell::s_info))
+    if (value.inherits(&JSDOMWindowShell::s_info))
         return static_cast<JSDOMWindowShell*>(asObject(value))->impl();
 
+#if ENABLE(EVENTSOURCE)
+    CONVERT_TO_EVENT_TARGET(EventSource)
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     CONVERT_TO_EVENT_TARGET(DOMApplicationCache)
 #endif
@@ -142,6 +186,15 @@ EventTarget* toEventTarget(JSC::JSValue value)
 
 #if ENABLE(SHARED_WORKERS)
     CONVERT_TO_EVENT_TARGET(SharedWorker)
+    CONVERT_TO_EVENT_TARGET(SharedWorkerContext)
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+    CONVERT_TO_EVENT_TARGET(Notification)
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    CONVERT_TO_EVENT_TARGET(WebSocket)
 #endif
 
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
index 493166c..10f8bd5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -34,114 +34,130 @@
 #include "JSCustomPositionErrorCallback.h"
 #include "JSDOMWindow.h"
 #include "PositionOptions.h"
+#include <runtime/InternalFunction.h>
 
 using namespace JSC;
+using namespace std;
 
 namespace WebCore {
 
-static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
+static PassRefPtr<PositionCallback> createPositionCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
 {
-    if (!value.isObject())
+    // The spec specifies 'FunctionOnly' for this object.
+    if (!value.inherits(&InternalFunction::info)) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
+    }
 
     JSObject* object = asObject(value);
+    return JSCustomPositionCallback::create(object, globalObject);
+}
 
-    JSValue enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
-    if (exec->hadException())
+static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
+{
+    // Argument is optional (hence undefined is allowed), and null is allowed.
+    if (value.isUndefinedOrNull())
         return 0;
-    bool enableHighAccuracy = enableHighAccuracyValue.toBoolean(exec);
-    if (exec->hadException())
+
+    // The spec specifies 'FunctionOnly' for this object.
+    if (!value.inherits(&InternalFunction::info)) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
+    }
 
-    JSValue timeoutValue = object->get(exec, Identifier(exec, "timeout"));
+    JSObject* object = asObject(value);
+    return JSCustomPositionErrorCallback::create(object, globalObject);
+}
+
+static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
+{
+    // Create default options.
+    RefPtr<PositionOptions> options = PositionOptions::create();
+
+    // Argument is optional (hence undefined is allowed), and null is allowed.
+    if (value.isUndefinedOrNull()) {
+        // Use default options.
+        return options.release();
+    }
+
+    // Given the above test, this will always yield an object.
+    JSObject* object = value.toObject(exec);
+
+    // For all three properties, we apply the following ...
+    // - If the getter or the property's valueOf method throws an exception, we
+    //   quit so as not to risk overwriting the exception.
+    // - If the value is absent or undefined, we don't override the default.
+    JSValue enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
     if (exec->hadException())
         return 0;
-    unsigned timeout = timeoutValue.toUInt32(exec);
+    if (!enableHighAccuracyValue.isUndefined()) {
+        options->setEnableHighAccuracy(enableHighAccuracyValue.toBoolean(exec));
+        if (exec->hadException())
+            return 0;
+    }
+
+    JSValue timeoutValue = object->get(exec, Identifier(exec, "timeout"));
     if (exec->hadException())
         return 0;
+    if (!timeoutValue.isUndefined()) {
+        // Wrap to int32 and force non-negative to match behavior of window.setTimeout.
+        options->setTimeout(max(0, timeoutValue.toInt32(exec)));
+        if (exec->hadException())
+            return 0;
+    }
 
     JSValue maximumAgeValue = object->get(exec, Identifier(exec, "maximumAge"));
     if (exec->hadException())
         return 0;
-    unsigned maximumAge = maximumAgeValue.toUInt32(exec);
-    if (exec->hadException())
-        return 0;
+    if (!maximumAgeValue.isUndefined()) {
+        // Wrap to int32 and force non-negative to match behavior of window.setTimeout.
+        options->setMaximumAge(max(0, maximumAgeValue.toInt32(exec)));
+        if (exec->hadException())
+            return 0;
+    }
 
-    return PositionOptions::create(enableHighAccuracy, timeout, maximumAge);
+    return options.release();
 }
 
 JSValue JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
-    RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(0).getObject();
+
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
     if (exec->hadException())
         return jsUndefined();
-    if (!object) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
+    ASSERT(positionCallback);
+
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+    if (exec->hadException())
         return jsUndefined();
-    }
 
-    if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
-        positionCallback = JSCustomPositionCallback::create(object, frame);
-    
-    RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(1).isUndefinedOrNull()) {
-        JSObject* object = args.at(1).getObject();
-        if (!object) {
-            setDOMException(exec, TYPE_MISMATCH_ERR);
-            return jsUndefined();
-        }
-
-        if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
-            positionErrorCallback = JSCustomPositionErrorCallback::create(object, frame);
-    }
-    
-    RefPtr<PositionOptions> positionOptions;
-    if (!args.at(2).isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(2));
-        if (exec->hadException())
-            return jsUndefined();
-    }
+    RefPtr<PositionOptions> positionOptions = createPositionOptions(exec, args.at(2));
+    if (exec->hadException())
+        return jsUndefined();
+    ASSERT(positionOptions);
 
     m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
-    
     return jsUndefined();
 }
 
 JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
-    RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(0).getObject();
+
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
     if (exec->hadException())
         return jsUndefined();
-    if (!object) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
+    ASSERT(positionCallback);
+
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+    if (exec->hadException())
         return jsUndefined();
-    }
-    
-    if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
-        positionCallback = JSCustomPositionCallback::create(object, frame);
-    
-    RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(1).isUndefinedOrNull()) {
-        JSObject* object = args.at(1).getObject();
-        if (!object) {
-            setDOMException(exec, TYPE_MISMATCH_ERR);
-            return jsUndefined();
-        }
-        
-        if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
-            positionErrorCallback = JSCustomPositionErrorCallback::create(object, frame);
-    }
-    
-    RefPtr<PositionOptions> positionOptions;
-    if (!args.at(2).isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(2));
-        if (exec->hadException())
-            return jsUndefined();
-    }
+
+    RefPtr<PositionOptions> positionOptions = createPositionOptions(exec, args.at(2));
+    if (exec->hadException())
+        return jsUndefined();
+    ASSERT(positionOptions);
 
     int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     return jsNumber(exec, watchID);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index 37561af..30892e0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLAppletElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLAppletElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLAppletElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
new file mode 100644
index 0000000..8ecd287
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLCanvasElement.h"
+
+#include "HTMLCanvasElement.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSHTMLCanvasElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(impl());
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, canvas->renderingContext());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 2570bc6..bce3ffb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLEmbedElement::getOwnPropertySlotDelegate(ExecState* exec, const Ident
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLEmbedElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index c8aea9f..6e01513 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -32,16 +32,20 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
     if (protocolIsJavaScript(deprecatedParseURL(value))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
@@ -55,8 +59,7 @@ void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
     if (!allowSettingJavascriptURL(exec, imp, srcValue))
         return;
 
-    imp->setSrc(srcValue);
-    return;
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
@@ -68,7 +71,6 @@ void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
         return;
 
     imp->setLocation(locationValue);
-    return;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
index 8e32381..60ea45e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -32,12 +32,15 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLIFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
@@ -45,11 +48,12 @@ void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
     String srcValue = valueToStringWithNullCheck(exec, value);
 
     if (protocolIsJavaScript(deprecatedParseURL(srcValue))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return;
     }
 
-    imp->setSrc(srcValue);
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index 6b47622..e5166ee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "HTMLInputElement.h"
 #include "Settings.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index a99e46c..1bfb51f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLObjectElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLObjectElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLObjectElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
index 86b7df7..b24b1ff 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -31,6 +31,7 @@
 
 #include "Frame.h"
 #include "History.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -92,6 +93,52 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing History cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, impl()->frame(), message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        // Allow access to back(), forward() and go() from any frame.
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsHistoryPrototypeFunctionBack) {
+                slot.setCustom(this, nonCachingStaticBackFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionForward) {
+                slot.setCustom(this, nonCachingStaticForwardFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionGo) {
+                slot.setCustom(this, nonCachingStaticGoFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            PropertySlot slot;
+            slot.setCustom(this, objectToStringFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    printErrorMessageForFrame(impl()->frame(), message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
@@ -100,20 +147,20 @@ bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutProp
     return false;
 }
 
-bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow deleting by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return false;
-    return Base::deleteProperty(exec, propertyName, checkDontDelete);
+    return Base::deleteProperty(exec, propertyName);
 }
 
-void JSHistory::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames, listedAttributes);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
index faaaf41..0f4a991 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLImageElement.h"
 #include "JSNode.h"
 #include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index fff7aee..7daeec7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectedObjectWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectorCallbackWrapper.h"
 #include <runtime/JSGlobalObject.h>
 #include <wtf/StdLibExtras.h>
@@ -125,3 +127,5 @@ JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index b2eb2d1..c80441d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -33,6 +33,8 @@
 #include "config.h"
 #include "JSInspectorBackend.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Console.h"
 #if ENABLE(DATABASE)
 #include "Database.h"
@@ -51,6 +53,10 @@
 #include "JSRange.h"
 #include "Node.h"
 #include "Page.h"
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#include "JSStorage.h"
+#endif
 #include "TextIterator.h"
 #include "VisiblePosition.h"
 #include <runtime/JSArray.h>
@@ -70,21 +76,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState*, const JSC::ArgList& args)
+JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return jsUndefined();
-
-    impl()->highlight(node);
-
+    impl()->highlight(args.at(0).toInt32(exec));
     return jsUndefined();
 }
 
@@ -280,4 +277,94 @@ JSValue JSInspectorBackend::profiles(JSC::ExecState* exec, const JSC::ArgList&)
 
 #endif
 
+JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
+    if (!node)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
+}
+
+JSValue JSInspectorBackend::wrapObject(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return impl()->wrapObject(ScriptValue(args.at(0))).jsValue();
+}
+
+JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
+}
+
+JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Node* node = toNode(wrapper->unwrappedObject());
+    if (!node)
+        return jsUndefined();
+
+    bool selectInUI = args.at(1).toBoolean(exec);
+    return jsNumber(exec, impl()->pushNodePathToFrontend(node, selectInUI));
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Database* database = toDatabase(wrapper->unwrappedObject());
+    if (database)
+        impl()->selectDatabase(database);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Storage* storage = toStorage(wrapper->unwrappedObject());
+    if (storage)
+        impl()->selectDOMStorage(storage);
+    return jsUndefined();
+}
+#endif
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 0e14109..e7d3f51 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectorCallbackWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectedObjectWrapper.h"
 #include <wtf/StdLibExtras.h>
 
@@ -73,7 +75,7 @@ JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwra
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, asObject(wrap(unwrappedExec, prototype))->inheritorID());
+    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
 }
 
 JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
@@ -105,3 +107,5 @@ JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExe
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
index f4758e4..cf0ed44 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -23,6 +23,7 @@
 #include "Frame.h"
 #include "JSNode.h"
 #include <runtime/FunctionConstructor.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSLock.h>
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -97,7 +98,7 @@ void JSLazyEventListener::parseCode() const
     ExecState* exec = m_globalObject->globalExec();
 
     MarkedArgumentBuffer args;
-    UString sourceURL(executionContext->url().string().operator UString());
+    UString sourceURL(executionContext->url().string());
     args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index 4fcf548..ef58349 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -31,6 +31,7 @@
 #include "KURL.h"
 #include "Location.h"
 #include "ScriptController.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -93,6 +94,51 @@ bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& p
     return true;
 }
 
+bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    Frame* frame = impl()->frame();
+    if (!frame) {
+        descriptor.setUndefined();
+        return true;
+    }
+    
+    // When accessing Location cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, frame, message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    PropertySlot slot;
+    if (entry && (entry->attributes() & Function)) {
+        if (entry->function() == jsLocationPrototypeFunctionReplace) {
+            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionReload) {
+            slot.setCustom(this, nonCachingStaticReloadFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionAssign) {
+            slot.setCustom(this, nonCachingStaticAssignFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
+    // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
+    // such cases when normally the string form of Location would be the URL.
+    
+    printErrorMessageForFrame(frame, message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
@@ -120,20 +166,20 @@ bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JS
     return false;
 }
 
-bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow deleting by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return false;
-    return Base::deleteProperty(exec, propertyName, checkDontDelete);
+    return Base::deleteProperty(exec, propertyName);
 }
 
-void JSLocation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames, listedAttributes);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
@@ -245,13 +291,13 @@ void JSLocation::setHash(ExecState* exec, JSValue value)
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    String oldRef = url.ref();
+    String oldFragmentIdentifier = url.fragmentIdentifier();
     String str = value.toString(exec);
     if (str.startsWith("#"))
         str = str.substring(1);
-    if (oldRef == str || (oldRef.isNull() && str.isEmpty()))
+    if (equalIgnoringNullity(oldFragmentIdentifier, str))
         return;
-    url.setRef(str);
+    url.setFragmentIdentifier(str);
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 25a5cb2..9721ba3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -30,6 +30,7 @@
 #include "JSDocument.h"
 #include "JSMessageChannel.h"
 #include "MessageChannel.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp
index d3b5878..574e28a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,20 +32,20 @@ using namespace JSC;
 
 namespace WebCore {
     
-void JSMessageChannel::mark()
+void JSMessageChannel::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     if (MessagePort* port = m_impl->port1()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 
     if (MessagePort* port = m_impl->port2()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
new file mode 100644
index 0000000..4c61c04
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSMessageEvent.h"
+
+#include "JSDOMBinding.h"
+#include "JSDOMWindow.h"
+#include "JSEventTarget.h"
+#include "JSMessagePortCustom.h"
+#include "MessageEvent.h"
+#include <runtime/JSArray.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSMessageEvent::ports(ExecState* exec) const
+{
+    MessagePortArray* ports = static_cast<MessageEvent*>(impl())->ports();
+    if (!ports || ports->isEmpty())
+        return jsNull();
+
+    MarkedArgumentBuffer list;
+    for (size_t i = 0; i < ports->size(); i++)
+        list.append(toJS(exec, globalObject(), (*ports)[i].get()));
+    return constructArray(exec, list);
+}
+
+JSC::JSValue JSMessageEvent::initMessageEvent(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& dataArg = args.at(3).toString(exec);
+    const UString& originArg = args.at(4).toString(exec);
+    const UString& lastEventIdArg = args.at(5).toString(exec);
+    DOMWindow* sourceArg = toDOMWindow(args.at(6));
+    OwnPtr<MessagePortArray> messagePorts;
+    if (!args.at(7).isUndefinedOrNull()) {
+        messagePorts = new MessagePortArray();
+        fillMessagePortArray(exec, args.at(7), *messagePorts);
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    MessageEvent* event = static_cast<MessageEvent*>(this->impl());
+    event->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg, originArg, lastEventIdArg, sourceArg, messagePorts.release());
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index 71472d5..8202d1a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -28,27 +28,30 @@
 
 #include "AtomicString.h"
 #include "Event.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSMessagePortCustom.h"
 #include "MessagePort.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSMessagePort::mark()
+void JSMessagePort::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
-    markIfNotNull(m_impl->onmessage());
+    markIfNotNull(markStack, m_impl->onmessage());
 
     // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
     if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 
     typedef MessagePort::EventListenersMap EventListenersMap;
@@ -56,7 +59,7 @@ void JSMessagePort::mark()
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -65,10 +68,12 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -77,11 +82,54 @@ JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+JSC::JSValue JSMessagePort::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
+}
+
+void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortArray& portArray)
+{
+    // Convert from the passed-in JS array-like object to a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    if (value.isUndefinedOrNull()) {
+        portArray.resize(0);
+        return;
+    }
+
+    // Validation of sequence types, per WebIDL spec 4.1.13.
+    unsigned length;
+    JSObject* object = toJSSequence(exec, value, length);
+    if (exec->hadException())
+        return;
+
+    portArray.resize(length);
+    for (unsigned i = 0 ; i < length; ++i) {
+        JSValue value = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        // Validation of non-null objects, per HTML5 spec 8.3.3.
+        if (value.isUndefinedOrNull()) {
+            setDOMException(exec, INVALID_STATE_ERR);
+            return;
+        }
+
+        // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
+        RefPtr<MessagePort> port = toMessagePort(value);
+        if (!port) {
+            throwError(exec, TypeError);
+            return;
+        }
+        portArray[i] = port.release();
+    }
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
new file mode 100644
index 0000000..7e90943
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSMessagePortCustom_h
+#define JSMessagePortCustom_h
+
+#include "MessagePort.h"
+#include <runtime/JSValue.h>
+
+namespace WebCore {
+
+    typedef int ExceptionCode;
+
+    class String;
+
+    // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    // May generate an exception via the passed ExecState.
+    void fillMessagePortArray(JSC::ExecState*, JSC::JSValue, MessagePortArray&);
+
+    // Helper function to convert from JS postMessage arguments to WebCore postMessage arguments.
+    template <typename T>
+    inline JSC::JSValue handlePostMessage(JSC::ExecState* exec, const JSC::ArgList& args, T* impl)
+    {
+        String message = args.at(0).toString(exec);
+        MessagePortArray portArray;
+        fillMessagePortArray(exec, args.at(1), portArray);
+        if (exec->hadException())
+            return JSC::jsUndefined();
+
+        ExceptionCode ec = 0;
+        impl->postMessage(message, &portArray, ec);
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+}
+#endif // JSMessagePortCustom_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
index f36a7d6..a1cb202 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
@@ -89,4 +89,37 @@ bool JSNamedNodesCollection::getOwnPropertySlot(ExecState* exec, const Identifie
     return DOMObjectWithGlobalPointer::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSNamedNodesCollection::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        descriptor.setDescriptor(jsNumber(exec, m_nodes->size()), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok);
+    if (ok && index < m_nodes->size()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete);
+        return true;
+    }
+    
+    // For IE compatibility, we need to be able to look up elements in a
+    // document.formName.name result by id as well as be index.
+    
+    AtomicString atomicPropertyName = propertyName;
+    for (unsigned i = 0; i < m_nodes->size(); i++) {
+        Node* node = (*m_nodes)[i].get();
+        if (node->hasAttributes() && node->attributes()->id() == atomicPropertyName) {
+            PropertySlot slot;
+            slot.setCustomIndex(this, i, indexGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete);
+            return true;
+        }
+    }
+    
+    return DOMObjectWithGlobalPointer::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
index cd6c2cb..fc629d8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
@@ -40,6 +40,7 @@ namespace WebCore {
         JSNamedNodesCollection(JSC::ExecState*, JSDOMGlobalObject*, const Vector<RefPtr<Node> >&);
 
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
index ea6cceb..c023931 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
@@ -29,13 +29,13 @@ namespace WebCore {
 
 using namespace JSC;
 
-void JSNavigator::mark()
+void JSNavigator::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
-    markDOMObjectWrapper(globalData, impl()->optionalGeolocation());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalGeolocation());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 2f080b8..e88a9ec 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -110,25 +110,37 @@ JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+        
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -136,22 +148,21 @@ void JSNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
 {
 }
 
-void JSNode::mark()
+void JSNode::markChildren(MarkStack& markStack)
 {
-    ASSERT(!marked());
-
     Node* node = m_impl.get();
 
+    Base::markChildren(markStack);
+    markEventListeners(markStack, node->eventListeners());
+
     // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
     // the document, we need to mark the document, but we don't need to explicitly
     // mark any other nodes.
     if (node->inDocument()) {
-        Base::mark();
-        markEventListeners(node->eventListeners());
-        if (Document* doc = node->ownerDocument())
+        if (Document* doc = node->ownerDocument()) {
             if (DOMObject* docWrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), doc))
-                if (!docWrapper->marked())
-                    docWrapper->mark();
+                markStack.append(docWrapper);
+        }
         return;
     }
 
@@ -163,33 +174,17 @@ void JSNode::mark()
 
     // Nodes in a subtree are marked by the tree's root, so, if the root is already
     // marking the tree, we don't need to explicitly mark any other nodes.
-    if (root->inSubtreeMark()) {
-        Base::mark();
-        markEventListeners(node->eventListeners());
+    if (root->inSubtreeMark())
         return;
-    }
 
     // Mark the whole tree subtree.
     root->setInSubtreeMark(true);
     for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
         JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
-        if (wrapper) {
-            if (!wrapper->marked())
-                wrapper->mark();
-        } else if (nodeToMark == node) {
-            // This is the case where the map from the document to wrappers has
-            // been cleared out, but a wrapper is being marked. For now, we'll
-            // let the rest of the tree of wrappers get collected, because we have
-            // no good way of finding them. Later we should test behavior of other
-            // browsers and see if we need to preserve other wrappers in this case.
-            if (!marked())
-                mark();
-        }
+        if (wrapper)
+            markStack.append(wrapper);
     }
     root->setInSubtreeMark(false);
-
-    // Double check that we actually ended up marked. This assert caught problems in the past.
-    ASSERT(marked());
 }
 
 static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 2595af5..a199417 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -36,10 +36,9 @@ JSNodeFilterCondition::JSNodeFilterCondition(JSValue filter)
 {
 }
 
-void JSNodeFilterCondition::mark()
+void JSNodeFilterCondition::markAggregate(MarkStack& markStack)
 {
-    if (!m_filter.marked())
-        m_filter.mark();
+    markStack.append(m_filter);
 }
 
 short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
index 3d591c6..b96534a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -39,7 +39,7 @@ namespace WebCore {
         JSNodeFilterCondition(JSC::JSValue filter);
 
         virtual short acceptNode(ScriptState*, Node*) const;
-        virtual void mark();
+        virtual void markAggregate(JSC::MarkStack&);
 
         mutable JSC::JSValue m_filter;
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
index a48a59d..2a99a93 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,10 +35,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSNodeFilter::mark()
+void JSNodeFilter::markChildren(MarkStack& markStack)
 {
-    impl()->mark();
-    Base::mark();
+    Base::markChildren(markStack);
+    impl()->markAggregate(markStack);
 }
 
 JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
@@ -48,7 +48,7 @@ JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
 
 PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
 {
-    if (value.isObject(&JSNodeFilter::s_info))
+    if (value.inherits(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
 
     return NodeFilter::create(JSNodeFilterCondition::create(value));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
index a2b9658..6a09abf 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,12 +29,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSNodeIterator::mark()
+void JSNodeIterator::markChildren(MarkStack& markStack)
 {
+    Base::markChildren(markStack);
+
     if (NodeFilter* filter = m_impl->filter())
-        filter->mark();
-    
-    Base::mark();
+        filter->markAggregate(markStack);
 }
 
 JSValue JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
index 2b8bd5d..7da0666 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLOptionElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
index 56b0eca..ada2a77 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -86,6 +86,22 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
+{
+    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    if (!runtimeObject)
+        return false;
+    if (!runtimeObject->hasProperty(exec, propertyName))
+        return false;
+    PropertySlot slot;
+    slot.setCustom(element, runtimeObjectPropertyGetter);
+    // While we don't know what the plugin allows, we do know that we prevent
+    // enumeration or deletion of properties, so we mark plugin properties
+    // as DontEnum | DontDelete
+    descriptor.setDescriptor(slot.getValue(exec, propertyName), DontEnum | DontDelete);
+    return true;
+}
+
 bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
     RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
index 8c9dfa7..a5a323a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -33,6 +33,7 @@ namespace WebCore {
     JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
+    bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, JSHTMLElement*);
     bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index 3ca0dd4..a071a4e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -92,14 +92,12 @@ void JSQuarantinedObjectWrapper::transferExceptionToExecState(ExecState* exec) c
     exec->setException(wrapOutgoingValue(unwrappedExecState(), exception));
 }
 
-void JSQuarantinedObjectWrapper::mark()
+void JSQuarantinedObjectWrapper::markChildren(MarkStack& markStack)
 {
-    JSObject::mark();
+    JSObject::markChildren(markStack);
 
-    if (!m_unwrappedObject->marked())
-        m_unwrappedObject->mark();
-    if (!m_unwrappedGlobalObject->marked())
-        m_unwrappedGlobalObject->mark();
+    markStack.append(m_unwrappedObject);
+    markStack.append(m_unwrappedGlobalObject);
 }
 
 bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, const Identifier& identifier, PropertySlot& slot)
@@ -140,6 +138,26 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     return result;
 }
 
+bool JSQuarantinedObjectWrapper::getOwnPropertyDescriptor(ExecState* exec, const Identifier& identifier, PropertyDescriptor& descriptor)
+{
+    if (!allowsGetProperty()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    PropertyDescriptor unwrappedDescriptor;
+    bool result = m_unwrappedObject->getOwnPropertyDescriptor(unwrappedExecState(), identifier, unwrappedDescriptor);
+
+    if (unwrappedDescriptor.hasAccessors()) {
+        descriptor.setAccessorDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.getter()),
+                                         wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.setter()),
+                                         unwrappedDescriptor.attributes());
+    } else
+        descriptor.setDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.value()), unwrappedDescriptor.attributes());
+    transferExceptionToExecState(exec);
+    return result;
+}
+
 void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     if (!allowsSetProperty())
@@ -160,12 +178,12 @@ void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSVal
     transferExceptionToExecState(exec);
 }
 
-bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier, bool checkDontDelete)
+bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
 {
     if (!allowsDeleteProperty())
         return false;
 
-    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier, checkDontDelete);
+    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
 
     transferExceptionToExecState(exec);
 
@@ -268,12 +286,20 @@ CallType JSQuarantinedObjectWrapper::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray& array, unsigned listedAttributes)
+void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray& array)
+{
+    if (!allowsGetPropertyNames())
+        return;
+    
+    m_unwrappedObject->getPropertyNames(unwrappedExecState(), array);
+}
+
+void JSQuarantinedObjectWrapper::getOwnPropertyNames(ExecState*, PropertyNameArray& array)
 {
     if (!allowsGetPropertyNames())
         return;
 
-    m_unwrappedObject->getPropertyNames(unwrappedExecState(), array, listedAttributes);
+    m_unwrappedObject->getOwnPropertyNames(unwrappedExecState(), array);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index 95e42f6..37f2518 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -53,24 +53,26 @@ namespace WebCore {
     protected:
         JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
 
-        virtual void mark();
+        virtual void markChildren(JSC::MarkStack&);
 
     private:
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
 
         virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
 
-        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&, bool checkDontDelete = true);
+        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
 
         virtual JSC::CallType getCallData(JSC::CallData&);
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
 
         virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
-
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+        
+        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
         virtual JSC::UString className() const { return m_unwrappedObject->className(); }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
index 30d59aa..e022401 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -44,6 +44,11 @@ namespace WebCore {
     
 JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
 {
+    if (args.isEmpty()) {
+        setDOMException(exec, SYNTAX_ERR);
+        return jsUndefined();
+    }
+
     String sqlStatement = args.at(0).toString(exec);
     if (exec->hadException())
         return jsUndefined();
@@ -90,8 +95,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            callback = JSCustomSQLStatementCallback::create(object, frame);
+        callback = JSCustomSQLStatementCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<SQLStatementErrorCallback> errorCallback;
@@ -102,8 +106,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            errorCallback = JSCustomSQLStatementErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLStatementErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     ExceptionCode ec = 0;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 055368e..e8001de 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2009 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,14 +38,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSSVGElementInstance::mark()
+void JSSVGElementInstance::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     // Mark the wrapper for our corresponding element, so it can mark its event handlers.
     JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
-    if (correspondingWrapper && !correspondingWrapper->marked())
-        correspondingWrapper->mark();
+    if (correspondingWrapper)
+        markStack.append(correspondingWrapper);
 }
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
@@ -53,9 +54,11 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -65,9 +68,11 @@ JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
index a312225..651805c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
@@ -37,6 +37,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSSharedWorker.h"
 #include "SharedWorker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -45,15 +46,17 @@ namespace WebCore {
 const ClassInfo JSSharedWorkerConstructor::s_info = { "SharedWorkerConstructor", 0, 0, 0 };
 
 JSSharedWorkerConstructor::JSSharedWorkerConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSSharedWorkerConstructor::createStructure(globalObject->objectPrototype()))
+    : DOMConstructorObject(JSSharedWorkerConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
     putDirect(exec->propertyNames().prototype, JSSharedWorkerPrototype::self(exec, globalObject), None);
     // Host functions have a length property describing the number of expected arguments.
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructSharedWorker(ExecState* exec, JSObject*, const ArgList& args)
+static JSObject* constructSharedWorker(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
+    JSSharedWorkerConstructor* jsConstructor = static_cast<JSSharedWorkerConstructor*>(constructor);
+
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
@@ -62,13 +65,13 @@ static JSObject* constructSharedWorker(ExecState* exec, JSObject*, const ArgList
     if (exec->hadException())
         return 0;
 
-    ScriptExecutionContext* context = static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject())->scriptExecutionContext();
+    // FIXME: We need to use both the dynamic scope and the lexical scope (dynamic scope for resolving the worker URL)
+    DOMWindow* window = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
     ExceptionCode ec = 0;
-    RefPtr<SharedWorker> worker = SharedWorker::create(scriptURL, name, context, ec);
+    RefPtr<SharedWorker> worker = SharedWorker::create(scriptURL, name, window->document(), ec);
     setDOMException(exec, ec);
 
-    // FIXME: toJS() creates an object whose prototype is derived from lexicalGlobalScope, which is incorrect (Bug 27088)
-    return asObject(toJS(exec, worker.release()));
+    return asObject(toJS(exec, jsConstructor->globalObject(), worker.release()));
 }
 
 ConstructType JSSharedWorkerConstructor::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp
new file mode 100644
index 0000000..dca3536
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSSharedWorkerContext.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSSharedWorkerContext::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    markIfNotNull(markStack, impl()->onconnect());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
index 8553298..f21f50c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
@@ -41,14 +41,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSSharedWorker::mark()
+void JSSharedWorker::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     if (MessagePort* port = impl()->port()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
index 4af5ddd..e416d35 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
@@ -47,7 +47,7 @@ JSValue JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, c
     return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
 }
 
-bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName, bool /*checkDontDelete*/)
+bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only perform the custom delete if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
@@ -64,14 +64,13 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName,
     return true;
 }
 
-void JSStorage::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    ExceptionCode ec;
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
-        propertyNames.add(Identifier(exec, m_impl->key(i, ec)));
+        propertyNames.add(Identifier(exec, m_impl->key(i)));
         
-    Base::getPropertyNames(exec, propertyNames, listedAttributes);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 00dacee..d711b6f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,20 +52,25 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, StyleSheet* style
     return wrapper;
 }
 
-void JSStyleSheet::mark()
+void JSStyleSheet::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
+
+    StyleSheet* sheet = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = sheet->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, sheet->item(i));
 
     // This prevents us from having a style sheet with a dangling ownerNode pointer.
     // A better solution would be to handle this on the DOM side -- if the style sheet
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = impl()->ownerNode()) {
-        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode)) {
-            if (!ownerNodeWrapper->marked())
-                ownerNodeWrapper->mark();
-        }
+    if (Node* ownerNode = sheet->ownerNode()) {
+        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
+            markStack.append(ownerNodeWrapper);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index 1da6418..7bf9389 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +35,18 @@ using namespace JSC;
 
 namespace WebCore {
 
+void JSStyleSheetList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    StyleSheetList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
 bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheetList, const Identifier& propertyName)
 {
     return styleSheetList->getNamedItem(propertyName);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
index 58eea72..f879cf4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,12 +29,12 @@ using namespace JSC;
 
 namespace WebCore {
     
-void JSTreeWalker::mark()
+void JSTreeWalker::markChildren(MarkStack& markStack)
 {
+    Base::markChildren(markStack);
+
     if (NodeFilter* filter = m_impl->filter())
-        filter->mark();
-    
-    Base::mark();
+        filter->markAggregate(markStack);
 }
     
 JSValue JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.cpp
new file mode 100644
index 0000000..5b34765
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "JSWebSocketConstructor.h"
+
+#include "JSWebSocket.h"
+#include "ScriptExecutionContext.h"
+#include "WebSocket.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebSocketConstructor);
+
+const ClassInfo JSWebSocketConstructor::s_info = { "WebSocketConstructor", 0, 0, 0 };
+
+JSWebSocketConstructor::JSWebSocketConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebSocketConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebSocketPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontDelete | DontEnum);
+}
+
+static JSObject* constructWebSocket(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebSocketConstructor* jsConstructor = static_cast<JSWebSocketConstructor*>(constructor);
+    ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "WebSocket constructor associated document is unavailable");
+
+    if (args.size() == 0)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    const String& urlString = args.at(0).toString(exec);
+    if (exec->hadException())
+        return throwError(exec, SyntaxError, "wrong URL");
+    const KURL& url = context->completeURL(urlString);
+    RefPtr<WebSocket> webSocket = WebSocket::create(context);
+    ExceptionCode ec = 0;
+    if (args.size() < 2)
+        webSocket->connect(url, ec);
+    else {
+        const String& protocol = args.at(1).toString(exec);
+        if (exec->hadException())
+            return 0;
+        webSocket->connect(url, protocol, ec);
+    }
+    setDOMException(exec, ec);
+    return CREATE_DOM_OBJECT_WRAPPER(exec, jsConstructor->globalObject(), WebSocket, webSocket.get());
+}
+
+ConstructType JSWebSocketConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructWebSocket;
+    return ConstructTypeHost;
+}
+
+}  // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
new file mode 100644
index 0000000..069647a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSWebSocketConstructor_h
+#define JSWebSocketConstructor_h
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+class JSWebSocketConstructor : public DOMConstructorObject {
+  public:
+    JSWebSocketConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+    static const JSC::ClassInfo s_info;
+
+  private:
+    virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+};
+
+}  // namespace WebCore
+
+#endif  // JSWebSocketConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
new file mode 100644
index 0000000..401b33d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "JSWebSocket.h"
+
+#include "KURL.h"
+#include "WebSocket.h"
+#include "NotImplemented.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebSocket::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+    if (m_impl->readyState() != WebSocket::CLOSED)
+        markIfNotNull(markStack, m_impl->onmessage());
+    // FIXME: mark if EventListeners is registered.
+}
+
+// Custom functions
+JSValue JSWebSocket::send(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    const String& msg = args.at(0).toString(exec);
+    if (exec->hadException())
+        return throwError(exec, SyntaxError, "bad message data.");
+    ExceptionCode ec = 0;
+    JSValue ret = jsBoolean(impl()->send(msg, ec));
+    setDOMException(exec, ec);
+    return ret;
+}
+
+// FIXME: implement addEventListener/removeEventListener.
+
+}  // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
index e1686f7..69c05e7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSWorker.h"
 #include "Worker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -62,7 +63,12 @@ static JSObject* constructWorker(ExecState* exec, JSObject* constructor, const A
     // See section 4.8.2 step 14 of WebWorkers for why this is the lexicalGlobalObject. 
     DOMWindow* window = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
 
-    RefPtr<Worker> worker = Worker::create(scriptURL, window->document());
+    ExceptionCode ec = 0;
+    RefPtr<Worker> worker = Worker::create(scriptURL, window->document(), ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return 0;
+    }
 
     return asObject(toJS(exec, jsConstructor->globalObject(), worker.release()));
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
index 622da70..1e4df42 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -32,6 +32,7 @@
 #include "JSWorkerContextBase.h"
 
 #include "JSDedicatedWorkerContext.h"
+#include "JSSharedWorkerContext.h"
 #include "JSWorkerContext.h"
 #include "WorkerContext.h"
 
@@ -83,10 +84,26 @@ JSDedicatedWorkerContext* toJSDedicatedWorkerContext(JSValue value)
     return 0;
 }
 
+#if ENABLE(SHARED_WORKERS)
+JSSharedWorkerContext* toJSSharedWorkerContext(JSValue value)
+{
+    if (!value.isObject())
+        return 0;
+    const ClassInfo* classInfo = asObject(value)->classInfo();
+    if (classInfo == &JSSharedWorkerContext::s_info)
+        return static_cast<JSSharedWorkerContext*>(asObject(value));
+    return 0;
+}
+#endif
+
 JSWorkerContext* toJSWorkerContext(JSValue value)
 {
-    // When we support shared workers, we'll add code to test for SharedWorkerContext too.
-    return toJSDedicatedWorkerContext(value);
+    JSWorkerContext* context = toJSDedicatedWorkerContext(value);
+#if ENABLE(SHARED_WORKERS)
+    if (!context)
+        context = toJSSharedWorkerContext(value);
+#endif
+    return context;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
index f7ad17f..a9a6e63 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
@@ -34,6 +34,7 @@
 namespace WebCore {
 
     class JSDedicatedWorkerContext;
+    class JSSharedWorkerContext;
     class JSWorkerContext;
     class WorkerContext;
 
@@ -61,6 +62,10 @@ namespace WebCore {
     JSDedicatedWorkerContext* toJSDedicatedWorkerContext(JSC::JSValue);
     JSWorkerContext* toJSWorkerContext(JSC::JSValue);
 
+#if ENABLE(SHARED_WORKERS)
+    JSSharedWorkerContext* toJSSharedWorkerContext(JSC::JSValue);
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 6a7602d..9e54fa0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -43,29 +43,33 @@
 #include "WorkerNavigator.h"
 #include <interpreter/Interpreter.h>
 
+#if ENABLE(EVENTSOURCE)
+#include "JSEventSourceConstructor.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
-void JSWorkerContext::mark()
+void JSWorkerContext::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     JSGlobalData& globalData = *this->globalData();
 
-    markActiveObjectsForContext(globalData, scriptExecutionContext());
+    markActiveObjectsForContext(markStack, globalData, scriptExecutionContext());
 
-    markDOMObjectWrapper(globalData, impl()->optionalLocation());
-    markDOMObjectWrapper(globalData, impl()->optionalNavigator());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
 
-    markIfNotNull(impl()->onerror());
+    markIfNotNull(markStack, impl()->onerror());
 
     typedef WorkerContext::EventListenersMap EventListenersMap;
     typedef WorkerContext::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = impl()->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -77,6 +81,21 @@ bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifi
     return false;
 }
 
+bool JSWorkerContext::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+    return false;
+}
+
+#if ENABLE(EVENTSOURCE)
+JSValue JSWorkerContext::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -107,19 +126,21 @@ JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 
 JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
 {
-    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSEventListener* listener = findJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
index 6010f83..a42a043 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -30,17 +30,23 @@
 #include "JSWorker.h"
 
 #include "JSDOMGlobalObject.h"
+#include "JSMessagePortCustom.h"
 #include "Worker.h"
 
 using namespace JSC;
 
 namespace WebCore {
-    
-void JSWorker::mark()
+
+void JSWorker::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
+
+    markIfNotNull(markStack, static_cast<Worker*>(impl())->onmessage());
+}
 
-    markIfNotNull(static_cast<Worker*>(impl())->onmessage());
+JSC::JSValue JSWorker::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index a644c9e..91fff9a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -23,6 +23,7 @@
 #include "JSXMLHttpRequest.h"
 #include "ScriptExecutionContext.h"
 #include "XMLHttpRequest.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 06a5817..c69f727 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -49,29 +49,29 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSXMLHttpRequest::mark()
+void JSXMLHttpRequest::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     if (XMLHttpRequestUpload* upload = m_impl->optionalUpload()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), upload);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 
-    markIfNotNull(m_impl->onreadystatechange());
-    markIfNotNull(m_impl->onabort());
-    markIfNotNull(m_impl->onerror());
-    markIfNotNull(m_impl->onload());
-    markIfNotNull(m_impl->onloadstart());
-    markIfNotNull(m_impl->onprogress());
+    markIfNotNull(markStack, m_impl->onreadystatechange());
+    markIfNotNull(markStack, m_impl->onabort());
+    markIfNotNull(markStack, m_impl->onerror());
+    markIfNotNull(markStack, m_impl->onload());
+    markIfNotNull(markStack, m_impl->onloadstart());
+    markIfNotNull(markStack, m_impl->onprogress());
     
     typedef XMLHttpRequest::EventListenersMap EventListenersMap;
     typedef XMLHttpRequest::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -123,9 +123,9 @@ JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
         JSValue val = args.at(0);
         if (val.isUndefinedOrNull())
             impl()->send(ec);
-        else if (val.isObject(&JSDocument::s_info))
+        else if (val.inherits(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val.isObject(&JSFile::s_info))
+        else if (val.inherits(&JSFile::s_info))
             impl()->send(toFile(val), ec);
         else
             impl()->send(val.toString(exec), ec);
@@ -168,10 +168,12 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -180,10 +182,12 @@ JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index 597010c..2f17542 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -41,28 +41,28 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSXMLHttpRequestUpload::mark()
+void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), xmlHttpRequest);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 
-    markIfNotNull(m_impl->onabort());
-    markIfNotNull(m_impl->onerror());
-    markIfNotNull(m_impl->onload());
-    markIfNotNull(m_impl->onloadstart());
-    markIfNotNull(m_impl->onprogress());
+    markIfNotNull(markStack, m_impl->onabort());
+    markIfNotNull(markStack, m_impl->onerror());
+    markIfNotNull(markStack, m_impl->onload());
+    markIfNotNull(markStack, m_impl->onloadstart());
+    markIfNotNull(markStack, m_impl->onprogress());
     
     typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
     typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -71,10 +71,12 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -83,10 +85,12 @@ JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgLi
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
index 01e53a6..441bbc9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -49,7 +49,7 @@ namespace WebCore {
 JSValue JSXSLTProcessor::importStylesheet(ExecState*, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         impl()->importStylesheet(node->impl());
         return jsUndefined();
@@ -62,7 +62,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 {
     JSValue nodeVal = args.at(0);
     JSValue docVal = args.at(1);
-    if (nodeVal.isObject(&JSNode::s_info) && docVal.isObject(&JSDocument::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info) && docVal.inherits(&JSDocument::s_info)) {
         WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
         Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
         return toJS(exec, impl()->transformToFragment(node, doc).get());
@@ -74,7 +74,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 JSValue JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
         if (resultDocument)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index 28cbe60..9e64bce 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -101,9 +101,9 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
     for (size_t i = 0; i < size; ++i)
         args.append(m_args[i]);
 
-    globalObject->globalData()->timeoutChecker->start();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, m_function, callType, callData, thisValue, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
         reportCurrentException(exec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
index 016c7a7..2c4075a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
@@ -37,8 +37,8 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptArray::ScriptArray(JSArray* object)
-    : ScriptObject(object)
+ScriptArray::ScriptArray(ScriptState* scriptState, JSArray* object)
+    : ScriptObject(scriptState, object)
 {
 }
 
@@ -51,57 +51,58 @@ static bool handleException(ScriptState* scriptState)
     return false;
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, const ScriptObject& value)
+bool ScriptArray::set(unsigned index, const ScriptObject& value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, value.jsObject());
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, value.jsObject());
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, const String& value)
+bool ScriptArray::set(unsigned index, const String& value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsString(scriptState, value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsString(m_scriptState, value));
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, double value)
+bool ScriptArray::set(unsigned index, double value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsNumber(scriptState, value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsNumber(m_scriptState, value));
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, long long value)
+bool ScriptArray::set(unsigned index, long long value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsNumber(scriptState, value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsNumber(m_scriptState, value));
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, int value)
+bool ScriptArray::set(unsigned index, int value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsNumber(scriptState, value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsNumber(m_scriptState, value));
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, bool value)
+bool ScriptArray::set(unsigned index, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsBoolean(value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsBoolean(value));
+    return handleException(m_scriptState);
 }
 
-unsigned ScriptArray::length(ScriptState*)
+unsigned ScriptArray::length()
 {
+    JSLock lock(SilenceAssertionsOnly);
     return jsArray()->length();
 }
 
 ScriptArray ScriptArray::createNew(ScriptState* scriptState)
 {
     JSLock lock(SilenceAssertionsOnly);
-    return ScriptArray(constructEmptyArray(scriptState));
+    return ScriptArray(scriptState, constructEmptyArray(scriptState));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.h
index 2ba307f..9240368 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.h
@@ -40,17 +40,17 @@ namespace WebCore {
 
     class ScriptArray : public ScriptObject {
     public:
-        ScriptArray(JSC::JSArray*);
+        ScriptArray(ScriptState*, JSC::JSArray*);
         ScriptArray() {}
         JSC::JSArray* jsArray() const { return asArray(jsValue()); }
 
-        bool set(ScriptState*, unsigned index, const ScriptObject&);
-        bool set(ScriptState*, unsigned index, const String&);
-        bool set(ScriptState*, unsigned index, double);
-        bool set(ScriptState*, unsigned index, long long);
-        bool set(ScriptState*, unsigned index, int);
-        bool set(ScriptState*, unsigned index, bool);
-        unsigned length(ScriptState*);
+        bool set(unsigned index, const ScriptObject&);
+        bool set(unsigned index, const String&);
+        bool set(unsigned index, double);
+        bool set(unsigned index, long long);
+        bool set(unsigned index, int);
+        bool set(unsigned index, bool);
+        unsigned length();
 
         static ScriptArray createNew(ScriptState*);
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
index 58168d0..09752d1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -40,7 +40,7 @@ namespace WebCore {
 
 ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, const ArgList& args, unsigned skipArgumentCount)
     : m_functionName(functionName)
-    , m_sourceURL(urlString)
+    , m_sourceURL(ParsedURLString, urlString)
     , m_lineNumber(lineNumber)
 {
     size_t argumentCount = args.size();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index 2abe5b0..4b33069 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -33,6 +33,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
+#include "StorageNamespace.h"
 #include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
@@ -110,9 +111,9 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
     RefPtr<Frame> protect = m_frame;
 
-    m_windowShell->window()->globalData()->timeoutChecker->start();
+    m_windowShell->window()->globalData()->timeoutChecker.start();
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
-    m_windowShell->window()->globalData()->timeoutChecker->stop();
+    m_windowShell->window()->globalData()->timeoutChecker.stop();
 
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
@@ -130,6 +131,14 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     return JSValue();
 }
 
+void ScriptController::evaluateInIsolatedWorld(unsigned /* worldID */, const Vector<ScriptSourceCode>& sourceCode) 
+{
+    // FIXME: Actually support isolated worlds!
+    unsigned size = sourceCode.size();
+    for (unsigned i = 0; i < size; ++i)
+        evaluate(sourceCode[i]);
+}
+
 void ScriptController::clearWindowShell()
 {
     if (!m_windowShell)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index 4528495..56e8f0c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -81,6 +81,7 @@ public:
     }
 
     ScriptValue evaluate(const ScriptSourceCode&);
+    void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
index b573b97..3fe471d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
@@ -28,8 +28,8 @@
 #include "ScriptController.h"
 
 #include "PluginView.h"
-#include "runtime_root.h"
 #include "runtime.h"
+#include "runtime_root.h"
 
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
index ca6b03a..46e80ac 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -170,7 +170,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
         return ScriptObject();
     }
 
-    return ScriptObject(asObject(result));
+    return ScriptObject(m_exec, asObject(result));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
index e664645..b527a96 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -40,8 +40,9 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptObject::ScriptObject(JSObject* object)
+ScriptObject::ScriptObject(ScriptState* scriptState, JSObject* object)
     : ScriptValue(object)
+    , m_scriptState(scriptState)
 {
 }
 
@@ -54,66 +55,66 @@ static bool handleException(ScriptState* scriptState)
     return false;
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const String& name, const String& value)
+bool ScriptObject::set(const String& name, const String& value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsString(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+bool ScriptObject::set(const char* name, const ScriptObject& value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), value.jsObject(), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), value.jsObject(), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, const String& value)
+bool ScriptObject::set(const char* name, const String& value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsString(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, double value)
+bool ScriptObject::set(const char* name, double value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, long long value)
+bool ScriptObject::set(const char* name, long long value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, int value)
+bool ScriptObject::set(const char* name, int value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, bool value)
+bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsBoolean(value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsBoolean(value), slot);
+    return handleException(m_scriptState);
 }
 
 ScriptObject ScriptObject::createNew(ScriptState* scriptState)
 {
     JSLock lock(SilenceAssertionsOnly);
-    return ScriptObject(constructEmptyObject(scriptState));
+    return ScriptObject(scriptState, constructEmptyObject(scriptState));
 }
 
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
@@ -123,6 +124,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const S
     return handleException(scriptState);
 }
 
+#if ENABLE(INSPECTOR)
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorBackend* value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -130,6 +132,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+#endif // ENABLE(INSPECTOR)
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
 {
@@ -141,7 +144,7 @@ bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptO
     if (!jsValue.isObject())
         return false;
 
-    value = ScriptObject(asObject(jsValue));
+    value = ScriptObject(scriptState, asObject(jsValue));
     return true;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
index 97022da..a8b11e0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -42,25 +42,30 @@ namespace WebCore {
 
     class ScriptObject : public ScriptValue {
     public:
-        ScriptObject(JSC::JSObject*);
+        ScriptObject(ScriptState*, JSC::JSObject*);
         ScriptObject() {}
         JSC::JSObject* jsObject() const { return asObject(jsValue()); }
 
-        bool set(ScriptState*, const String& name, const String&);
-        bool set(ScriptState*, const char* name, const ScriptObject&);
-        bool set(ScriptState*, const char* name, const String&);
-        bool set(ScriptState*, const char* name, double);
-        bool set(ScriptState*, const char* name, long long);
-        bool set(ScriptState*, const char* name, int);
-        bool set(ScriptState*, const char* name, bool);
+        bool set(const String& name, const String&);
+        bool set(const char* name, const ScriptObject&);
+        bool set(const char* name, const String&);
+        bool set(const char* name, double);
+        bool set(const char* name, long long);
+        bool set(const char* name, int);
+        bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
+    
+    protected:
+        ScriptState* m_scriptState;
     };
 
     class ScriptGlobalObject {
     public:
         static bool set(ScriptState*, const char* name, const ScriptObject&);
+#if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+#endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
     private:
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
index 171883a..b48556e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "ScriptObjectQuarantine.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Document.h"
 #include "Frame.h"
 #include "JSDOMBinding.h"
@@ -38,6 +40,7 @@
 #include "JSNode.h"
 #include "ScriptObject.h"
 #include "ScriptValue.h"
+#include "Storage.h"
 
 #include <runtime/JSLock.h>
 
@@ -73,23 +76,24 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
     ExecState* exec = globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, database))));
+    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, database))));
 
     return true;
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
 {
-    ASSERT(frame);
     ASSERT(storage);
+    Frame* frame = storage->frame();
+    ASSERT(frame);
 
     JSDOMGlobalObject* globalObject = toJSDOMWindow(frame);
     ExecState* exec = globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, storage))));
+    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, storage))));
 
     return true;
 }
@@ -103,7 +107,7 @@ bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
 
     JSLock lock(SilenceAssertionsOnly);
     // FIXME: Should use some sort of globalObjectFromNode()
-    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, deprecatedGlobalObjectForPrototype(exec), node))));
+    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, deprecatedGlobalObjectForPrototype(exec), node))));
 
     return true;
 }
@@ -116,10 +120,12 @@ bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedO
     ExecState* exec = window->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, window)));
+    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, window)));
 
     return true;
 }
 
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
index d70acd7..df52379 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
@@ -37,7 +37,6 @@ namespace WebCore {
 
     class Database;
     class DOMWindow;
-    class Frame;
     class Node;
     class ScriptObject;
     class ScriptValue;
@@ -49,7 +48,7 @@ namespace WebCore {
     bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
 #endif
 #if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
 #endif
     bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
     bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
index d427cee..6eac102 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
@@ -74,4 +74,11 @@ bool ScriptValue::isUndefined() const
     return m_value.get().isUndefined();
 }
 
+bool ScriptValue::isObject() const
+{
+    if (!m_value)
+        return false;
+    return m_value.get().isObject();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
index 209ce06..19bb693 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
@@ -50,6 +50,7 @@ public:
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
+    bool isObject() const;
     bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index 1b8eed6..3590dad 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -32,8 +32,10 @@
 
 #include "JSDOMBinding.h"
 #include "JSDedicatedWorkerContext.h"
+#include "JSSharedWorkerContext.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
+#include "WorkerContext.h"
 #include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
 #include <interpreter/Interpreter.h>
@@ -73,12 +75,22 @@ void WorkerScriptController::initScript()
     RefPtr<Structure> workerContextPrototypeStructure = JSWorkerContextPrototype::createStructure(jsNull());
     ProtectedPtr<JSWorkerContextPrototype> workerContextPrototype = new (m_globalData.get()) JSWorkerContextPrototype(workerContextPrototypeStructure.release());
 
-    // FIXME: When we add SharedWorkerContext, generate the correct wrapper here.
-    RefPtr<Structure> dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(workerContextPrototype);
-    ProtectedPtr<JSDedicatedWorkerContextPrototype> dedicatedContextPrototype = new (m_globalData.get()) JSDedicatedWorkerContextPrototype(dedicatedContextPrototypeStructure.release());
-    RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(dedicatedContextPrototype);
-
-    m_workerContextWrapper = new (m_globalData.get()) JSDedicatedWorkerContext(structure.release(), static_cast<DedicatedWorkerContext*>(m_workerContext));
+    if (m_workerContext->isDedicatedWorkerContext()) {
+        RefPtr<Structure> dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(workerContextPrototype);
+        ProtectedPtr<JSDedicatedWorkerContextPrototype> dedicatedContextPrototype = new (m_globalData.get()) JSDedicatedWorkerContextPrototype(dedicatedContextPrototypeStructure.release());
+        RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(dedicatedContextPrototype);
+
+        m_workerContextWrapper = new (m_globalData.get()) JSDedicatedWorkerContext(structure.release(), m_workerContext->toDedicatedWorkerContext());
+#if ENABLE(SHARED_WORKERS)
+    } else {
+        ASSERT(m_workerContext->isSharedWorkerContext());
+        RefPtr<Structure> sharedContextPrototypeStructure = JSSharedWorkerContextPrototype::createStructure(workerContextPrototype);
+        ProtectedPtr<JSSharedWorkerContextPrototype> sharedContextPrototype = new (m_globalData.get()) JSSharedWorkerContextPrototype(sharedContextPrototypeStructure.release());
+        RefPtr<Structure> structure = JSSharedWorkerContext::createStructure(sharedContextPrototype);
+
+        m_workerContextWrapper = new (m_globalData.get()) JSSharedWorkerContext(structure.release(), m_workerContext->toSharedWorkerContext());
+#endif
+    }
 }
 
 ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
@@ -109,11 +121,9 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
     JSLock lock(SilenceAssertionsOnly);
 
     ExecState* exec = m_workerContextWrapper->globalExec();
-    m_workerContextWrapper->globalData()->timeoutChecker->start();
+    m_workerContextWrapper->globalData()->timeoutChecker.start();
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
-    m_workerContextWrapper->globalData()->timeoutChecker->stop();
-
-    m_workerContext->thread()->workerObjectProxy().reportPendingActivity(m_workerContext->hasPendingActivity());
+    m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
         return comp.value();
@@ -136,7 +146,7 @@ void WorkerScriptController::forbidExecution()
     // It is not critical for Interpreter::m_timeoutTime to be synchronized, we just rely on it reaching the worker thread's processor sooner or later.
     MutexLocker lock(m_sharedDataMutex);
     m_executionForbidden = true;
-    m_globalData->timeoutChecker->setTimeoutInterval(1); // 1ms is the smallest timeout that can be set.
+    m_globalData->timeoutChecker.setTimeoutInterval(1); // 1ms is the smallest timeout that can be set.
 }
 
 } // namespace WebCore
author	Jocelyn Turcotte <jocelyn.turcotte@nokia.com>	2009-09-18 08:35:59 (GMT)
committer	Jocelyn Turcotte <jocelyn.turcotte@nokia.com>	2009-09-18 08:38:07 (GMT)
commit	ef310719ef42cd09e2542fce96c529b5657bf167 (patch)
tree	c691bab10518e479ce40d4cac6c79daa312fce87 /src/3rdparty/webkit/WebCore/bindings/js
parent	5b828316abb0ad1a33cdc11ebac0999d9b79576a (diff)
download	Qt-ef310719ef42cd09e2542fce96c529b5657bf167.zip Qt-ef310719ef42cd09e2542fce96c529b5657bf167.tar.gz Qt-ef310719ef42cd09e2542fce96c529b5657bf167.tar.bz2